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UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 

MICHAEL ROSATO, MURRY B. MOSKOWlfz, 
and BRUCE OUELLETTE, on their own behalf and 
on behalf of all others similarly situated, 

Plaintiffs, 



R. JAMES NICHOLSON, in his Offieial Capacity 
as Secretary of Veterans Affairs, 
810 Vermont Avenue, NW, 
Washington, DC 20420, and 

UNITED STATES DEPARTMENT OF 
VETERANS AFFAIRS, 
8 ] Vermont Avenue, N W, 
Washington, DC 20420, 

Defendants, 



COMPLAINT /f^ ^ 

".' -.'..■'' *■■■' 

JURY TRIAL DEMANDEC^ -' 

VlTALIAWO,,J. 



COME NOW PLAINTIFFS, Michael Rosato, Murry B. Moskowitz and Bruce Ouellctte, 
and in support of their Complaint herein allege as follows: 

NATURE OF THE ACTION 

1 . This is a class action for declaratory and injunctive relief and money damages for 
the violations of the Administrative Procedures Act and the Privacy Act of 1974 and the Fourth 
and Fifth Amendments to the United States Constitution under the authority of Bivens v. Six 
Unknown Named Agents of (he Federal Bureau of Narcotics, 403 U.S. 388 (1971). Plaintiffs 
represent approximately 26.5 million individuals who are both veterans and active service 
members of the Armed Services of the United States who have suffered emotional trauma, have 
been placed in fear of identity theft, destruction of credit and financial fraud, and who have had 
their private and personal health care information compromised because of Defendants' 
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intentional, wiilful and reckless disregard for the security and privacy of these citizens' basic 
personal information. 

2. Defendant Nicholson failed to properly perform the duties of his position as 
Secretary of Veterans Affairs ("Secretary") and did not protect the privacy rights of Plaintiffs and 
the other class members and failed to institute and enforce procedures mandated by law for the 
protection of veterans' and service members' private and personal infomiation, 

3. Defendant United States Department of Veterans Affairs ("Department" or "VA") 
also did not assure that class members' privacy rights were protected, failed to institute and 
enforce procedures mandated by law for the protection of veterans' and service members' private 
and personal infomiation, and flagrantly disregarded the privacy rights of virtually all armed 
service members by illegally maintaining a database of personal information unrelated to claims 
for benefits and by requiring that veterans' and service members' records be maintained and 
accessed through their individual, private and personal social security numbers or other 
identifiers that were required by law to be kept confidential. 

4. Defendants compounded their disregard for veterans' and service members' 

privacy rights by recklessly failing to make even the most rudimentary effort to safeguard this 
trove of personally identifiable information from unauthorized disclosure. In fact, the 
information was unencrypted, easily copied, and, apparently, available to anyone aware of its 
existence. Defendants' failures, despite repeated calls for correction of these long-standing, 
fundamental security deficiencies, allowed millions of eirizens' private infonnation to be 
compromised and disclosed to unknown individuals for unknown purposes. 

5. Defendants impropedy, unlawfully, willfully and intentionally disclosed the 

private and personal information of Plaintiffs and the Class in at least three ways: (1 ) through 

2 
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VA employees' improper access and removal of data files containing the private personal 
information of 26.5 million veterans and active service members from the VA; (2) through the 
transfer by VA personnel of the data to external and unprotected disks and/or computers; and (3) 
through the alleged theft of these disks and/or computers by a third party or parties, whose 
identity may never be known. 

6. The result of Defendants' reckless disregard of the privacy rights of the Class was 
the largest unauthorized disclosure of Social Security numbers, addresses, telephone numbers 
and health information in history. 

7. Defendants' actions and inactions have inflicted serious harm and will continue to 
inflict real costs and emotional pain and suffering on Plaintiffs and every other living veteran and 
their families whose identities and other personal and private infbnnation have been 
compromised. 

8. Defendants' willful and intentional failure to establish and enforce appropriate 
safeguards to ensure the security and privacy of veteran records and to protect against any known 
or anticipated threats or hazards to the security and integrity of these records is in violation of 5 
U.S.C. § 552a{e)(10) and other laws. Furthermore, subsequent to learning of the foregoing 
unauthorized disclosures, Defendants were deliberately indifferent in failing to take reasonable 
eoiTeetive action, including but not limited to, providing prompt and accurate notification of the 
disclosures to law enforcement and the affected veterans despite knowledge of the substantial 
risk of serious harm to the personal and ilnaneial security of the affected veterans as result of the 
disclosures. 
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JURISDICTfON AND VFNl IF 

9. Jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1331 because this is 
a civil action arising under the taws of the United States. Jurisdiction is also invoked pursuant to 
5 U.S.C. §§ 552a(g)(5) because this is a civil action to enforce a liability created under 5 U.S.C. 

§ 552a after September 27, 1 975. 

10. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C. § 1391(e), 

1 1 . Plaintiff Michael Rosato is a veteran of the United States Armed Services 
honorably discharged from service. He is a resident of Suffolk County, New York. 

1 2. Plaintiff Murry B. Moskowitz is a veteran of the United States Amied Services 
honorably discharged from service. He is a resident of Fairfax County, Virginia. 

13. PlaintiffBruceOuellette is a disabled Vietnam combat veteran and a current 
resident of Yavapai County, Arizona. 

14. Defendant R. James Nicholson is the Secretary of Veterans Affairs and is the 
official responsible for the proper execution and administration of all laws administered by the 
Department and for the control, direction, and management of the Department. 

1 5. Defendant VA is an executive department of the federal government and is, 
therefore, an "agency" for purposes of the Privacy Act of 1974. 

STATEMENT OF FACTS 
! 6. Upon information and belief, VA employees were able to easily access computer 
files containing private Personal Infonnation of millions of veterans and copy the tiles from the 
VA\s system onto external disks and their personal computers. Upon further infonnation and 
belief, VA employees had, in tact, been removing the data fi-om the VA facility for a period of 
three years in a practice expressly or implicitly ratified by the VA. VA employees' access to and 

4 
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duplication of this information was a disclosure in violation of 5 IJ.S.C. 552a(b) and the result of 
Defendants' willful and intentional failure to establish appropriate safeguards to ensure the 
security and confidentiality of veteran records and to protect against any anticipated threats or 
hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(l 0). 

17. On May 3, 2006, a laptop computer and external data storage device or devices 
were reportedly stolen ti-om the Aspen Hill, Maryland home of John Doc, a VA employee. The 
laptop computer and data storage device or devices contained a copy of a collection or grouping 
of information pertaining to approximately 26.5 million persons (the "Personal Information"), 
including militaiy veterans and approximately 2.2 million current active service members and 
their spouses (or neariy 80 percent of the active duty force). The Personal Infoixnation contained 
individual identifying information including, but not limited to, names, addresses, phone 
numbers, social security numbers, dates of birth and health infomiation. hi addition, at least 
three hundred of the records contained disability information and information related to possible 
exposure to biological and chemical agents. None of the information was encrypted or similarly 
protected. 

18. Upon information and belief, John Doe had removed the VA files containing the 
private personal information of 26.5 million veterans from the VA facility and taken it to his 
home shortly before the theft described in the prior paragraph. John Doe then copied the files 
onto his computer and/or external disks for an unspecified purpose. John Doe's computer and/or 
disks were allegedly stolen during a burglary of his home. Upon information and belief, these 
items have not been recovered as of the date of the filing of this Complaint. They were not 
encrypted or password protected and are easily accessed and duplicated. 
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1 9. John Doe reported the Personal Information theft to one or more VA officials. 
These VA officials were aware of the unlawful disclosure of the Personal Informafion soon atler 
the occurrence, yet these VA officials willfully and intentionally decided to conceal the 
disclosure and did not report the incident to other VA officials, federal law enforcement, or 
inform the individuals whose Personal Infommation had been disclosed without authorization. 
These failures exhibit Defendants' reckless disregard for Plaintiffs' privacy rights, intentional 
and willful violations of the Privacy Act, and were otherwise not in accordance with law. 

20. No VA official charged with protecting the Personal Information pursuant to the 
Privacy Act and who knew of the unauthorized disclosure informed Defendant VA's Inspector 
General George Opfer of the disclosure. The Inspector General only learned of the incident 
through an offliand remark on iVlay 10, 2006. Then, the Inspector General further demonstrated 
VA's reckless disregard for the privacy rights of Plaintiffs and the Class and an intentional and 
willful disregard for Privacy Act requirements by failing to interview the employee in question 
until May 1 5, 2006, five days later. 

21. Defendant Nicholson was informed ofthe patently unlawful disclosure on May 
16, 2006, and the Federal Bureau of Invesfigation ("FBI") was contacted on May 17, 2006. 
Defendant Nicholson did not publicly infbrni Plaintiffs or any other individuals of VA's patently 
unlawful disclosure ofthe Personal Information until May 22, 2006, 19 days after the reported 
theft. 

22. Defendants' actions and inactions in failing to report the unauthorized disclosure 
ofthe Personal Infomiafion were arbitrary, capricious and without observance of procedures 
required by law. 
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23. Defendant VA has been repeatedly informed of recurring, systemic, and 
fundamental deficiencies in its information security, but failed to effectively respond. VA's own 
Inspector General has for years criticized the Department for lax information security Despite 
the repeated identification of problems, VA has been unable or unwilling to properly secure the 
personal information under its control. These repeated failures to correct known vulnerabilities 
of VA's safeguards for Plaintiffs' and class members' Personal Information demonstrated a 
reckless disregard for privacy rights and intentional or willful violations of the Privacy Act. 

24. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to observe the procedures required by law for disclosure of private 
information, including the Personal Information, without the prior written consent of the affected 
individuals. 

25. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by disclosing, or allowing disclosure of, the Personal Information to officials and 
employees who did not have a need for such records and information in the perfomiance of their 
duties. 

26. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to keep or maintain an accurate accounting of the disclosures of the 
Personal Information. 

27. VA also flagrantly disregarded the privacy of Plainfiffs and the Class and caused 
them adverse effects by assembling and maintaining the Personal Information in a system of 
records although the infonnation was not relevant and necessary to accomplish a purpose 
required by statute or by executive order of the President. 
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28. Defendants knew or should have known that their computer security practices 

e not in compiiance with 5 U.S.C. § 552a as well as other federal laws relating to information 

security. In 2003, a study conducted by the General Accounting Office ("GAO") gave the VA a 

failing grade for its computer security practices. In March 2006, the United States House of 

Representative's Committee on Government Reform gave the VA an "F" in its annual report 

card relating to information security. Despite this ample and specific notice of noncompliance 

and the potential adverse effect of random and unauthorized disclosures of Personal Information, 

Defendants failed to establish appropriate safeguards to ensure the security and confidentiality of 

veteran records and to protect against any anticipated threats or hazards to the security and 

integrity of these records in violation of 5 U.S.C. § 552a(e)(] 0). 

29. An Associated Press article published on June 14, 2006, concerning that day's 

testimony in Congressional hearings on the compromise of privacy laws at the VA, reported; 

In testimony to Congress, the Government Accountability Office and Veterans 
inspector general detailed ignored warnings, weak management and lax rules in 
their review of VA infonnation security following the theft of 26.5 million 
military personnel's private data last month. 

They found that the Veterans Affairs Department routinely failed to control and 
monitor employee access to private information, did not restrict users to "need-to- 
know" data and often waited too long to terminate accounts when an employee 
quit or was fired. 

The investigators also said the VA lacked a clear chain of command in enforcing 
security, noring the agency will need dramatically stronger leadership under VA 
Secretary .lim Nicholson to force reform af\er five years of repeated warnings 
about security. 

"Much work remains to be done," Linda Koontz, a director on infonnation 
management at GAO, told the House Veterans Affairs Committee. "Only through 
strong leadership, sustained management commitment and effori, disciplined 
processes, and consistent oversight can VA address its persistent, long-standing 
control weaknesses." 
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30. The testimony of June 14 made clear, according to the foregoing article, that; 

government investigators said the problem was long-standing and much more 
widespread. They pointed to repeated occasions in the last year in which VA 
employees passed along veterans' medical infoiTnation via unencrypted e-mail or 
were allowed to freely log into the VA secure network in their off-duty hours or 
even after they've been tenninated. 

In other instances, tiles were not adequately segregated or password-protected, 
making it easy for hackers to access the sensitive information. 

3 1 . Finally, the article underscored the fact that the defendants were aware of their 
privacy laws deficiencies for a very long time. 

When the VA was told of problems over the years, often it would make spotty 
improvements but fail to address reform agency-wide. The agency also has yet to 
put in place a security response program to monitor suspicious log-on activity, 
said Michael Staley, an assistant VA inspector general, in testimony. 

"These conditions place sensitive information, including financial data and 
sensitive veteran medical and benefit information, at risk, possibly without 
detection of inadvertent or deliberate misuse, fraudulent use, improper disclosure 
or destruction," Staley said. 

32. The unauthorized and unconsented disclosure of an individual's name, address, 
date of birth, health and/or disability status and Social Security number creates a substantial risk 
of identity theft and an invasion of privacy. An individual's Social Security number is the most 
useful identifier for retrieving infonnation from public record databases, financial institutions 
and credit bureaus. Armed with an individual's name, address, date of birth and Social Security 
number, an identity thief is able to quickly and easily steal an identity, whereas, without such 
infonnation, the task is difficult, time consuming and costly. Moreover, the unauthorized 
disclosure of an individual's health or disability status invades the privacy of information 
protected under law. 
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33. Recent nationwide studies confirm that, on average, vicUnis of identity theft spend 
hundreds of hours in personal time and hundreds of dollars in personal funds to resofve their 
credit issues. See www.idthettcenter.org; www.tlc.org. 

34. Defendants' unauthorized and unconsented disclosures of private Personal 
Infomiation and the imminent and substantial risk of identity theft to which the Class has been 
exposed is the direct result of Defendants' failure to: (1) establish appropriate administrative, 
technical and physical safeguards to ensure the security and confidentiality of records; (2) to 
protect against any anticipated threats or hazards to the security and integrity of these records; 
and (3) to promptly take reasonable measures to con-cct the disclosures, including but not limited 
to, providing law enforcement and the affected veterans with prompt and accurate notice of the 
disclosures, and free ongoing monitoring of class members' health and financial reports. 

35. As a direct and proximate result of Defendants' acts and omissions, the Class has 
been exposed to a risk of substantial harm and inconvenience, and has incurred actual damages in 
purchasing comprehensive credit reports and/or monitoring of their identity and credit. 
Furthermore, their individual privacy has been invaded through the disclosure of their private and 
personal health intbrmation. 

36. Defendant Nicholson was ultimately responsible for control, direction, and 
management of VA's processes, policies, and procedures for compliance with the Privacy Act of 
1974 and other privacy laws, rules and regulations, but failed to ensure those processes, policies, 
and procedures were adequately implemented by his subordinates. Defendant Nicholson knew, 
or should have known, that VA had long-standing information security deficiencies that 
threatened the privacy rights of PlainUffs and the Class, but did not ensure correction or 
mitigation of those deficiencies. 

10 
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37. Defendant Nicholson flagrantly disregarded the privacy rights of Plaintiffs and the 
Class and caused them adverse effects by failing to establish and ensure lawful compliance by his 
subordinates with appropriate administrative, technical, and physical safeguards to insure the 
security and confidentiality of records and to protect against anticipated threats or hazards to the 
records security or integrity, which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information was maintained. 

38. Each of Defendants' failures complained of caused adverse effects to the Class 
including, but not limited to, embarrassment, inconvenience, unfairness, mental distress, 
emotional trauma, pecuniary damages and the threat of current and future substantial harm from 
identity theft. In testimony to Congress on or about June 12, 2006, Defendant Nicholson said 
that although he remained hopeful that the theft fi-om the VA employee in Maryland was random, 
he and the VA could not count on the fact that no use of the stolen data was or would be made by 
unauthorized persons. 

39. The real threat of identity theft and similar adverse effects of VA's illegal actions 
and Privacy Act violations requires affirmative aefions by the Class to recover peace of mind, 
emotional stability, and personal security including, but not limited to, frequently obtaining and 
reviewing credit reports, bank statements, and other similar information, obtaining credit watch 
services, and closing financial accounts. The Class has, and will continue to, suffer tangible and 
intangible damages tbr the foreseeable future. 

40. In Congressional hearings held after the disclosure of the Personal Information 
discussed herein. Representative Henry Waxman of California berated defendant Nicholson for 
his conduct and malfeasance: 
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"Secretary Nicholson, you blame this on an employee who was fired, on a culture, 
on people doing what they're not supposed to be doing. That doesn't sound like ' 
we're getting to the heart of this with passing the buck." 

CLASS ACTION AIJ.EGATIONS 

41 . This action is maintainable as a class action pursuant to Federal Rules of Civil 
Procedure 23(a) and (b)( I )-(3). 

42. The Class consists of all persons who have been adversely effected by 
Defendants' violations of the privacy of class members' personal and private identifying 
infomiation. 

43. This action is properly maintainable as a class action for the following reasons; 

a. The Class is so numerous that joinder of all members ts impractible. The 
class size is approximately 26,500,000, which is the number of individuals whose information 
Deibndants admit was collected and maintained in the missing system of records. 

b. Joinder of class members' individual actions is impractical because of the 
geographical diversity of class members, the limited ability of individual class members to 
institute separate suits, and the general nature of the underlying action and relief sought. 

c. Plaintiffs are committed to the vigorous prosecution of this action and 
have retained counsel qualified and experienced to represent the Class and familiar with class 
litigation. Plaintiffs' claims arc typical of the claims of other members of the Class and plaintiffs 
have no interest that are adverse or antagonistic to the interests of the Class. Plaintiff^ are 
military veterans listed in one or more VA system of records who have had their personal 
information improperly maintained and disclosed by Defendants. 

d. The representative Plaintiffs will fairly and adequately protect the interests 
of the Class. 

12 
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e. There are substantial questions of fact and law common to all class 
members. The issues raised include whether Defendants acted or failed to act eommcnsurate 
with their duties to protect the personal, private and confidential information of Plaintiffs and 
class members, whether such conduct violated the privacy and other laws, whether said 
violations were willful, wanton and/or reckless and whether such conduct gives rise to the 
various forms of relief requested and/or damages. The foregoing issues are common to all class 
members. Similarly, the relief Plaintiffs seek is dominated by equitable remedies. The facts, 
circumstances, and merits of the case, therefore, apply equally to all class members. 

f Defendants have acted and refused to act on grounds generally applicable 

to the Class, making appropriate final injunctive and declaratory relief with respect to the Class 
as a whole. 

g. The prosecution of separate actions by individual class members would 
create a risk of inconsistent results that could establish incompatible standards of conduct for 
Defendants. 

h. Defendants' liability for damages can be established by facts and 

circumstances common to the Class as a whole and do not require the examinafion of Plaintiffs' 
individual circumstances. 

i. Questions of law and fact common to members of the Class predominate 

over any questions affecting only individual members. 

j. A class action is superior in this case to other methods for a fair and 

efficient adjudication of the controversy because the common interests of the class members 
predominate over any individual interest in controlling prosecution or control of separate actions 
and because conccntrafing the litigation in this Court is appropriate to ensure appropriate, 

13 
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consistent, and efficient resolution of the legal aiid constitutional issues raised in the district 
where the offending conduct occurred, continues to occur, and could occur in the future. 
FIRST CLAIM FOR RELIEF 

44. Plaintiffs reassert the allegations set forth in Paragraphs t through 43 above and 
incorporate them by reference into this First Claim for Relief 

45. Defendant VA possesses personal information of Plaintiffs and millions of other 
veterans and active service members. VA has repeatedly demonstrated an inability or 
unwillingness to implement, or callous disregard for, fundamental procedures to provide 
minimally acceptable safeguards for the personal and private information in its possession. 

46. Defendant Nicholson is ultimately responsible in his official capacity for 
safeguarding citizen's private infonnation under VA control pursuant to applicable laws, 
including the Privacy Act of 1 974 and the Administrative Procedures Act, but has been unable or 
unwilling to require compliance with those laws. 

47. Defendants' actions and inactions in failing to safeguard Plaintiffs' private 
infonnation were arbitrary, capricious, and otherwise not in accordance with law. 

48. Plaintiffs suffered, and continue to suffer, hami as a result of Defendants' actions 
and from actions improperly withheld or unreasonably delayed. 

49. The Class is entitled to monetary and equitable relief for Defendants' violation of 
plaintiffs' rights pursuant to the Administrative Procedures Act, 

50. The foregoing acts and omissions of Defendant VA constitute an unauthorized, 
nonconsensual, and inappropriate disclosure of Social Security numbers and private health 
information of the Class in violation of 5 U.S. C. § 552a(b). 
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SECOND CLAIM FOR RELIEF 

5 1 . Plaintiffs repeat and reaffirm the assertions of fact contained in paragraphs 1 
through 50 hereinabove. 

52. The foregoing acts and omissions of Defendant VA constitute a wiiiful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of the private personal records of the Class in violation of 5 U.S.C. § 552a(c){10). 

THIRD CLAIM FOR RELIEF 

53. Plaintiffs repeat and reaffimi the assertions of fact contained in paragraphs 1 
through 52 hereinabove. 

54. The foregoing acts and omissions of Defendants constitute a violation of the right 
to privacy and personal security of the Class in their Social Security numbers and private health 
inibrmation under the Fourth and Fifth Amendments to the United States Constitution. 

PRAY FOR RELIEF 
WHEREFORE, Plaintiffs pray as follows: 

a. For a declaration that Defendants' acts and omissions constitute a willful 
and intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran and active service member records and to protect against known and anticipated threats 
or hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(l 0) and 
the Fourth and Fifth Amendments of the United States Constitution. 

b. For preliminary and pennanent injunctive relief enjoining, prohibiting and 
preventing Defendants from continuing to operate without appropriate safeguards to ensure the 
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security and privacy of veteran records and to protect against anticipated threats or hazards to the 
security and integrity of these records. 

c. For reparative injunctive relief under Bivens requiring Defendants to take 
necessary measures to safeguard against the serious harm attendant to the improper 
disciosurc/theft of confidential information including an identity and/or credit monitoring 
program and a preemptive internet search service for the benefit of Plaintiffs and the proposed 
Class under the Court's supervision; 

d. That this Court permanently enjoin Defendant VA, its officers, agents, 
employees, and those acting for and with them, from accessing, viewing, handling, disclosing, or 
in any way transferring any record or system of records subject to Privacy Act requirements until 
an independent panel of experts finds that adequate information security has been established and 
implemented by VA, unless such activity is explicitly allowed by Court order and under 
supervision of persons independent of VA, such supervision to be at VA expense; 

e. That this Court enjoin Defendant VA, its officers, agents, employees, and 
those acting for and with them from removing any device capable of storing, containing, or 
transferring any record or system of records, including, but not limited to, laptop computers, 
portable hard drives, memory sfick or similar devices, and "iPods" and similar devices, from 
property under VA's supervision and control until and unless VA demonstrates that adequate 
intbnnation security has been established to the Court's satisfaction. 

f That this Court grant to Plaintiffs and the Class judgment against 

Defendant VA for damages in an amount of $1 ,000.00 for each individual who was adversely 
affected by Defendant's Privacy Act violations; 



nmi 



CagasleOIBQfiHflSOSe^eNJ^jTVIfiocLDtoeatTfeat 1 FiliSil^DmMyQiBI Pagagle^tPf (bf 17 



g. That this Court grant to Plaintiffs their costs and reasonable attorneys' 
fees; and 

h. That this Court grant such additional relief as the Court deems proper and 
just. 
Dated: June 21, 2006 
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UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 

MICHAEL ROSATO, MURRY B. MOSKOW1T2 ^ ^ " ^ ^ 

and BRUCE OUELLETTE, 

Plaintiff, cv-(J5liE© 



(ENV) 



. , IN CLERK'S OFFff^^ 
R. JAMES NICHOLSON, et al . , M 2 J 20% ^ 

Defendants. .... ^.M. ^ 

X nmAM- ■ ■ " 

An initial conference will be h.ld in tho above captioned case 
on October 24, 2006 at 12:45 P.M., before the Honorable Joan M. 
Azrack, united States Magistrate Judge, in Room 1210S at 225 Cadman 
Plaza East, Brooklyn, New York. Tn the event the complaint Is 
answered before the above date and you would prefer a conference 
sooner, of if this case becomes eligible for Arbitration, please 
contact Magistrate Azrack's chambers ^t 719-613-2530. ah coau^el 
must be present. 

Plaintiff^ » cnnnsPl is re cpaest.ed 1-o confirm ^y..^ . gi n.n.....y 

participant.s are awar^ »f ^-H ^ ^^ request for 

adjournment will be considered unless made at least forty-eight 
(48) hours before the scheduled conference. 
SO ORDERED. 

Dated: Brooklyn, New York 

June 22, 2 06 ^ s/JMA ^ 



JOAN M. AZRACK 
UNITED STATES MAGISTRATE JUDGE 
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BEFORE THE JUDICIAL PANEL 
ON MULTIDISTRICT LITIGATION 



IN RE VA DATA THEFT LITIGATION ) MDL Docket No. 

) 

DEFENDANTS DEPARTMENT OF VETERANS AFFAIRS, 

SECRETARY OF VETERANS AFFAIRS R. JAMES NICHOLSON, 

DEPUTY SECRETARY GORDON G. MANSFIELD, AND VA 

EMPLOYEE JOHN DOE'S MOTION FOR TRANSFER 

AND COORDINATION PURSUANT TO 28 U.S.C. § 1407 

Defendants Department of Veterans Affairs, Secretary of Veterans Affairs R. James 

Nicholson, Deputy Secretary Gordon G. Mansfield, and VA employee John Doe, hereby 

respectfully move the Judicial Panel on Multidistrict Litigation, pursuant to 28 U.S.C. § 1407, 

for an order transferring and consolidating for pretrial purposes Vietnam Veterans of America, 

Inc. V. Nicholson, No. l:06-cv-1038-JR, currently pending in the District Court for the District of 

Columbia, Hackettv. United States Department of Veterans Ajf airs. Case No. 2:06-cv-114- 

WOB, currently pending in the Eastern District of Kentucky, and Rosato v. Nicholson, 

1 :06-cv-03086-ENV-JMA, currently pending in the Eastern District of New York.' Defendants 



' This motion is made on behalf of Defendants Secretary Nicholson, Deputy Secretary 
Mansfield, and VA employee John Doe, in their official capacities only. Although all three 
individual defendants have been named as defendants in the Hackett case in both their official 
and individual capacities, they have not yet been properly served in their individual capacities. 
See Fed. R. Civ. P. 4(i)(2)(B). Plaintiffs in the Rosato case have not yet effected service on 
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recommend that the cases be consolidated in the District for the District of Columbia. In support 
of transfer and coordination of these actions, Defendants aver the following, as set forth more 
fully in the accompanying supporting memorandum: 

1. All three of these actions arise from, and seek damages and other relief for, the 
theft of data from the home of John Doe, an employee of the Department of Veterans Affairs 
("VA"). Accordingly, they "involv[e] one or more common questions of fact." 28 U.S.C. 

§ 1407(a). 

2. All three actions assert claims for damages under the Privacy Act, 5 U.S.C. 
§ 552a. 

3. All three actions have been brought as putative class actions on behalf of identical 
putative classes consisting of all individuals whose personal information was included in the 
stolen data. 

4. The proposed transfer and consolidation "will be for the convenience of the 
parties and witnesses and will promote the just and efficient conduct of such actions" for 
multiple reasons. See 28 U.S.C. § 1407(a). First, the data theft occurred at the home of John 
Doe, a VA employee who worked in Washington, D.C., and lives in suburban Washington, D.C. 
(Maryland), and involved data maintained by the VA in Washington, D.C. Accordingly, 
relevant information and witnesses are likely to be found in Washington, D.C, and its vicinity. 
Second, the scope of appropriate discovery is likely to arise in all three cases. Indeed, Plaintiffs' 
counsel in two of the cases have separately written to Defendants with respect to Defendants' 



Defendant Nicholson, the sole named defendant in that case. Although the instant Motion to 
Transfer is filed with respect to all three pending cases. Defendants do not waive proper service 
of process. 
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obligations to preserve evidence. Defendants should be subject to only one court's supervision 
of the discovery process. Third, as noted above, all three cases are brought on behalf of the same 
putative class of Plaintiffs. Defendants should not be subject to inconsistent class certification 
rulings. 

5. For all of these reasons, as well as the reasons set forth in the accompanying 
supporting memorandum and exhibits. Defendants respectfully request that the three cases be 
consolidated for pretrial proceedings before the District Court for the District of Columbia. 
Dated: July 10, 2006. Respectfully submitted, 

PETER D. KEISLER 

Assistant Attorney General 

ELIZABETH SHAPIRO 

Assistant Branch Director 

I3L 



ORI LEV 

Senior Trial Counsel 

DAVID M. GLASS 

Senior Trial Counsel 

HEATHER R. PHILLIPS 

Trial Attorney 

U.S. Department of Justice 

Civil Division/Federal Programs Branch 

Mail: P.O. Box 883 

Washington, D.C. 20044 
Street: 20 Massachusetts Ave., N.W. 

Room 7330 

Washington, DC 20001 
Ph: (202) 514-2395 
Fax: (202)318-7589 
Email: ori.lev@usdoj.gov 

Attorneys for Defendants Department of Veterans 
Affairs, Secretary of Veterans Affairs R. James 
Nicholson in his official capacity, Deputy Secretary 
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Gordon G. Mansfield in his official capacity, and 
Defendant John Doe in his official capacity. 
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BEFORE THE JUDICIAL PANEL 
ON MULTIDISTRICT LITIGATION 



IN RE VA DATA THEFT LITIGATION ) MDL Docket No. 

) 

MEMORANDUM IN SUPPORT OF DEFENDANTS 

DEPARTMENT OF VETERANS AFFAIRS, SECRETARY OF VETERANS AFFAIRS 

R. JAMES NICHOLSON, DEPUTY SECRETARY GORDON G. MANSFIELD, AND VA 

EMPLOYEE JOHN DOE'S MOTION FOR TRANSFER AND 

COORDINATION PURSUANT TO 28 U.S.C. § 1407 

Pursuant to 28 U.S.C. § 1407 and Rule 7. 1(b) of the Rules of Procedure of the Judicial 

Panel on Multidistrict Litigation, Defendants Department of Veterans Affairs, Secretary of 

Veterans Affairs R. James Nicholson, Deputy Secretary of Veterans Affairs Gordon G. 

Mansfield, and VA employee John Doe, seek transfer and pretrial coordination of three lawsuits, 

Vietnam Veterans of America, Inc. v. Nicholson, No. l:06-cv-1038-JR (currently pending in the 

District Court for the District of Columbia), Hackett v. United States Department of Veterans 

Affairs, Case No. 2:06-cv-l 14-WOB (currently pending in the Eastern District of Kentucky), and 

Rosato V. Nicholson, 1 :06-cv-03086-ENV-JMA (currently pending in the Eastern District of 

New York), each of which seeks to represent identical putative classes bringing similar claims 
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based on the same factual allegations.' Defendants recommend that the cases be consolidated in 
the District for the District of Columbia. A multidistrict litigation proceeding is warranted 
because all of the statutory criteria for transfer and coordination are present. 
BACKGROUND 

As has been widely reported in the press, a laptop and external hard drive containing 
personal information for approximately 26 million veterans and active duty personnel were 
stolen from the home of a VA employee on May 3, 2006. On June 29, 2006, authorities 
announced the recovery of the stolen equipment, and noted that preliminary review revealed that 
the data had not been accessed. See Christopher Lee and Ernesto Londono, "Stolen VA Laptop 
Recovered," June 27, 2006, available at < http://www. washingtonpost.com/wp-dyn/content/article 
/2006 /06/29/AR2006062900352.html?sub=AR>. 

In response to the VA data theft, three putative class action lawsuits have been filed 
bringing Privacy Act claims against Defendants." See Complaint in Vietnam Veterans of 
America, Inc. v. Nicholson, No. l:06-cv-1038-JR (D.D.C.), attached hereto as Exhibit A; 
Complaint in Rosato v. Nicholson, l:06-cv-03086-ENV-JMA (E.D.N.Y.), attached hereto as 



^ This motion is made on behalf of Defendants Secretary Nicholson, Deputy Secretary 
Mansfield, and VA employee John Doe, in their official capacities only. Although all three 
individual defendants have been named as defendants in the Hackett case in both their official 
and individual capacities, they have not yet been properly served in their individual capacities. 
See Fed. R. Civ. P. 4(i)(2)(B). Plaintiffs in the Rosato case have not yet effected service on 
Defendant Nicholson, the sole named defendant in that case. Although the instant Motion to 
Transfer is filed with respect to all three pending cases. Defendants do not waive proper service 
of process. 

" An additional fourth putative class action lawsuit was filed in the District for the 
District of Columbia, Kennedy v. United States Dep't of Veterans Affairs (06-1070) (D.D.C.); 
however, plaintiffs in that case voluntarily dismissed their complaint without prejudice on June 
28, 2006. 
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Exhibit B; Complaint in Hackett v. United States Department of Veterans Affairs, Case No. 2:06- 
cv-1 14-WOB (E.D.Ky.), attached hereto as Exhibit C. All of the complaints allege that in the 
May 2006 burglary, computer equipment was stolen from the home of VA employee John Doe. 
Ex. A 11 20; Ex. B 11 17; Ex. C 1[ 18. The complaints allege that the computer equipment 
contained personal information on millions of veterans and active duty personnel, which had 
been taken by John Doe from the VA headquarters where he worked. Ex. A ff 20, 27; Ex. B % 
17; Ex. C I 18. Likewise, all three complaints allege violations of the Privacy Act. See, 
generally, Exs. A, B, C. Moreover, each lawsuit seeks to represent the same nationwide putative 
class of people whose information was contained on the equipment that was stolen from John 
Doe's home. Ex. A <1[<1[ 42-44; Ex. B % 43; Ex. C I 27. Thus, there are currently three 
overlapping class action Privacy Act cases against the VA based on the same underlying 
conduct. The three cases are pending in three different jurisdictions (D.D.C., E.D. Ky., and 
E.D.N. Y.) and there is the possibility that additional cases may be filed. 
ARGUMENT 
This Panel is authorized under 28 U.S.C. § 1407 to consolidate and transfer "civil actions 
involving one or more common questions of fact" to any district court for coordinated or 
consolidated pretrial proceedings upon the Panel's "determination that transfers for such 
proceedings will be for the convenience of parties and witnesses and will promote the just and 
efficient conduct of such actions." 28 U.S.C. § 1407(a). The purpose of this transfer procedure 
is to conserve judicial resources and to avoid the delays that are bound to result if all aspects of 
pretrial proceedings were conducted separately. See Moore's Federal Practice - Civil, 
Chapter 112 Multidistrict Litigation § 1 12.02. The Panel's statutory mandate is to weigh the 
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interests of all the plaintiffs and all the defendants, and to consider multidistrict litigation as a 
whole in light of the purposes of the law. In re Library Editions of Children's Books, 297 F. 
Supp. 385, 386 (J.P.M.L. 1968). 

In making this determination, the Panel therefore examines whether: (1) the lawsuits at 
issue involve common questions of fact; (2) consolidation promotes the just and efficient 
conduct of the litigation by eliminating duplicative discovery, preventing inconsistent rulings on 
pretrial motions (including those with respect to certification of collective actions), and 
conserving the resources of the parties, their counsel and the judiciary; and (3) centralization 
under Section 1407 will serve the convenience of the parties and witnesses. In re Dollar 
General Corp., 346 F. Supp. 2d 1368 (J.P.M.L. 2004). The Panel also assesses the most 
appropriate district for the litigation, by examining, among other things, whether the proposed 
tribunal has the resources available to manage the Utigation. Id. 

All of the cases that Defendants seek to transfer and coordinate in the District Court for 
the District of Columbia fall squarely within the requirements of 28 U.S.C. § 1407(a), and 
significant benefits are to be gained by coordinated or consolidated pretrial proceedings. In re 
Falstaff Brewing Corporation Antitrust Litigation, 434 F. Supp. 1225, 1231 (J.P.M.L. 1977). It 
is beyond dispute that the three actions share common questions of fact, including the same 
causes of action and overlapping putative classes. Transferring these cases to one court for 
pretrial proceedings will be more convenient for the parties, will not prejudice any parties' 
interests, and will conserve judicial resources. 
I. The Actions Involve Common Questions of Fact 

Each of the three actions shares "one or more common questions of fact." 28 U.S.C. § 
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1407(a). Indeed, virtually every question of fact in these cases is in common, because these are 
essentially three versions of the same case, appearing to differ only in that they have been filed 
by different law firms with different named plaintiffs. All of the cases are based on the same 
underlying factual allegations, namely that VA employee John Doe took data (containing 
Privacy Act-protected information) from VA headquarters to his home, where it was stolen in a 
burglary. Ex. A ff 20, 27; Ex. B f 17; Ex. C f 18. All of the cases contend that the VA's 
conduct constituted one or more violations of the Privacy Act, thus raising common questions 
such as whether the VA willfully and intentionally failed to properly maintain the VA data that 
was stolen. See, e.g., Ex. A fi 20-41; Ex. B fi 2-8, 17-40; Ex. C ffl 1-6, 18-26. And, all of the 
cases purport to represent the same class. Ex. A llll 42-44; Ex. B % 43; Ex. C f 27. As such, this 
statutory requirement has been fulfilled. See, e.g.. In re Cooper Tire & Rubber Co. Tires Prods. 
Liab. Litig., No. 1393, 2001 WL 253115 (J.P.M.L. 2001) (transfer ordered where "[a]ll actions 
involve allegations relating to Cooper's tire design and its manufacturing process"); In re Air 
West, Inc. Securities Litig., 384 F. Supp. 609, 611 (J.P.M.L. 1974) ("[W]hen two or more 
complaints assert comparable allegations against identical defendants based upon similar 
transactions and events, common factual questions are presumed."). 

Moreover, the case for transfer and consolidation in these cases is particularly strong 
because Plaintiffs in each case seek certification of identical classes but with different class 
representatives. The "appearance of conflicting class representation claims . . . militates strongly 
in favor of transfer." In re Air West, 384 F. Supp. at 61 1 (consolidating three actions); accord In 
re Jamster Mktg. Litig., All F. Supp. 1366 (J.P.M.L. 2006) (ordering transfer and coordination 
of three class actions where "[e]ach action is brought as a class action against overlapping 
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defendants and is predicated on the same factual allegations" and finding that transfer "is 
necessary to eliminate duplicative discovery, prevent inconsistent pretrial rulings (especially 
with respect to potentially dispositive pretrial motions and class certification matters), and 
conserve the resources of the parties, their counsel, and the judiciary"); In re High Sulfur 
Content Gasoline Prods. Liab. Litig., 344 F. Supp. 2d 755, 756 (J.P.M.L. 2004) (ordering 
transfer and coordination of five "overlapping putative class actions"). Absent coordination, 
multiple federal courts will be simultaneously handling the same claims brought by the same 
putative class against the same defendants. 
II. Transfer Will Promote Just and Efficient Adjudication of these Actions. 

Because these three pending putative class actions are factually similar, advance similar 
causes of actions, and seek certification of overlapping, identical classes, pretrial proceedings in 
all these actions will involve identical issues.' Thus, each case will require the same discovery 
into the same facts, with testimony from the same witnesses, and the same potential discovery 
disputes. Additionally, each case will raise identical legal issues, including the propriety of class 
certification, the interpretation of the Privacy Act, and the scope of remedy, if any. Thus, 
transfer and consolidation of these cases in a single venue will result in enormous savings to the 
resources of parties, witnesses, and the courts. Additionally, consolidation will prevent both 



^ Three actions based on the same facts is a sufficient number to warrant transfer and 
coordination. See e.g.. In re Jamster Mktg. Litig., 2006 WL 1023460 (J.P.M.L.) (consolidating 
three actions); In re New Mexico Natural Gas Antitrust Litig., 482 F. Supp. 333 (J.P.M.L. 1979) 
(consolidating three actions); In re California Armored Car Antitrust Litig., 476 F. Supp. 452, 
454 (J.P.M.L. 1979) (consolidating three actions); In re First Nat'l Bank, 451 F. Supp. 995, 997 
(J.P.M.L. 1978) (consolidating two actions); In re Eastern Airlines, Inc. Flight Attendant Weight 
Program Litig., 391 F. Supp. 763 (J.P.M.L. 1975) (consolidating two actions); In re Cross- 
Florida Barge Canal Litig., 329 F. Supp. 543 (J.P.M.L. 1971) (consolidating two actions). 
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inconsistent legal rulings and inconsistent case management orders, both of which could 
prejudice the parties and undermine the systemic integrity of the judiciary. 

For these reasons, transfer and coordination of these actions will promote the just and 
efficient conduct of these actions. See, e.g., In re Prempro Products Liability Lit., 254 F. Supp. 
2d 1366, 1367 (J.P.M.L. 2003) ("[cjentralization under Section 1407 is necessary in order to 
eliminate duplicative discovery, prevent inconsistent pretrial rulings (especially with respect to 
the question of class certification), and conserve the resources of the parties, their counsel and 
the judiciary"). 
III. Transfer Will Promote the Convenience of the Parties and the Witnesses. 

As noted, all of these cases concern precisely the same underlying allegations about the 
alleged acts and omissions of the VA. Thus, the same witnesses, documents, and other evidence 
will be at issue in each case. Requiring duplicative litigation of discovery disputes (with the real 
possibility of inconsistent rulings and case management orders), and possible multiple 
productions of the same documents, as well as multiple depositions of the same witnesses, will 
waste resources of parties and witnesses (as well as judicial resources). Thus, consohdation will 
promote the efficiency interests of all involved. See, e.g.. In re High Sulfur Content, 344 F. 
Supp. 2d at 757 (finding that consolidation of actions from two districts would "conserve the 
resources of the parties, their counsel and the judiciary"). 

Moreover, the main issues for discovery will concern the manner in which the data was 
maintained at VA headquarters, the manner in which John Doe accessed the data at VA 
headquarters, and the manner in which that data was stolen from John Doe's home. The 
overwhelming number of relevant witnesses are thus likely to be employees (or former 
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employees) of VA and/or other individuals located in the Washington, D.C., area. It is unlikely 
that any information relevant to these topics will be sought from individuals located in the 
Eastern District of Kentucky, and the Eastern District of New York, where two of the lawsuits 
are pending. This particularly important factor thus strongly favors transfer to the District of 
Columbia for the convenience of the parties and witnesses. See In re Marsh & McLennan 
Companies, Inc., Securities Litigation, 429 F. Supp. 2d 1396 (J.P.M.L. 2006) (finding Southern 
District of New York to be the appropriate transfer forum given that the district was a likely 
source of relevant documents and witnesses as defendants in that case were headquartered there). 

IV. The District for the District of Columbia Is the Most Appropriate Transferee 
Forum 

The District for the District of Columbia, where one of the three cases - Vietnam 

Veterans - is currently pending (and another was dismissed without prejudice to the right to 

refile) is the most appropriate forum to handle this multidistrict litigation. As noted above, these 

cases are all based on underlying events that occurred in Washington, D.C., and a Maryland 

suburb. Thus, most, if not all, of the key witnesses are likely to be located in the Washington, 

D.C. area; most, if not all, of the relevant documents are likely to be located in the Washington, 

D.C., area; and the relevant premises are located in the Washington, D.C, area. Any third-party 

witnesses (for example former VA employees or witnesses with knowledge of the burglary) will 

most likely be within the subpoena power of the District for the District of Columbia. Thus, the 

District of Columbia is the most appropriate forum to handle the pretrial proceedings in these 

cases as this district has a significant nexus to the litigation. See, e.g.. In re Salomon Bros. 

Treasury Securities Litig., 796 F. Supp. 1537, 1538 (J.P.M.L. 1992) (designating as transferee 
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court the district where the documents and witnesses relating to the defendant's conduct were 
located); In re Air Disaster at Denver, 486 F. Supp. 241, 243 (J.P.M.L. 1980) (same); In re U.S. 
Financial Securities Litigation, 375 F. Supp. 1403, 1404 (J.P.M.L. 1978) (same). 

Moreover, of the districts where actions are pending, the District for the District of 
Columbia had the fewest pending cases per judge in 2005, the most recent year for which 
statistics are available. See Federal Court Management Statistics (2005), available at 
www.uscourts.gov/fcmstat/index.html. The District for D.C. had 309 pending cases per judge, 
while the Eastern District of New York and Eastern District of Kentucky had, respectively, 622 
and 397 pending cases per judge. The District of Columbia is therefore better equipped and has 
more resources available to handle this litigation. 

Finally, Congress has provided the District for the District of Columbia a special role in 
adjudicating Privacy Act cases. The District for the District of Columbia is the only district 
where venue is proper in every Privacy Act case. See 5 U.S.C. § 552a(g)(5). Because of this 
and because Washington, D.C, is the site of the federal government, the federal courts in 
Washington, D.C, have developed extensive caselaw and expertise with regard to the Privacy 
Act, and plaintiffs who do not live in D.C. frequently choose it as a venue for Privacy Act 
claims.'' Given these factors, the District of Columbia is the most appropriate forum for these 
cases. In re Dollar General Corp., 346 F. Supp. 2d at 1370 (noting appropriateness of transfer to 
Northern District of Alabama given familiarity with issues involved in litigation and fact that the 
"tribunal has the resources available to manage this litigation"). 



"* For example, of the nine plaintiffs in Vietnam Veterans of America, Inc. v. Nicholson, 
No. l:06-cv-1038-JR (D.D.C), none are residents of Washington, D.C. 
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CONCLUSION 

For the reasons stated above, these three cases should be consolidated for pretrial purposes 
in the District for the District of Columbia. 
Dated: July 10, 2006 Respectfully submitted, 

PETER D. KEISLER 

Assistant Attorney General 

ELIZABETH SHAPIRO 

Assistant Branch Director 

M 



ORI LEV 

Senior Trial Counsel 

DAVID M. GLASS 

Senior Trial Counsel 

HEATHER R. PHILLIPS 

Trial Attorney 

U.S. Department of Justice 

Civil Division/Federal Programs Branch 

Mail: P.O. Box 883 

Washington, D.C. 20044 
Street: 20 Massachusetts Ave., N.W. 

Room 7330 

Washington, DC 20001 
Ph: (202) 514-2395 
Fax: (202)318-7589 
Email: ori.lev@usdoj.gov 

Attorneys for Defendants Department of Veterans 
Affairs, Secretary of Veterans Affairs R. James 
Nicholson in his official capacity, Deputy Secretary 
Gordon G. Mansfield in his official capacity, and 
Defendant John Doe in his official capacity. 
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BEFORE THE JUDICIAL PANEL 
ON MULTIDISTRICT LITIGATION 



IN RE VA DATA THEFT LITIGATION ) 



MDL Docket No. _ 



DEFENDANTS' SCHEDULE OF ACTIONS FOR TRANSFER 
AND COORDINATION PURSUANT TO 28 U.S.C. § 1407 

Pursuant to Rule 7.2(a)(ii) of the Rules of Procedure of the Judicial Panel on Multidistrict 

Litigation, defendants provide the following information regarding pending actions that will be 

affected by defendants' Motion for Transfer and Coordination: 



Plaintiffs 


Defendants 


Dist./Div. 


Civil Action No. 


Judge Assigned 


Vietnam Veterans of 


R. James Nicholson; 


D.D.C./ 


l:06-cv-01038-JR 


The Honorable 


America, Inc.; Citizen 


United States Department of 


D.C. 




James Robertson 


Soldier, Inc.; National 


Veterans Affairs 








Gulf War Resource 










Center, Inc.; Radiated 










Veterans of America, 










Inc.; Veterans for 










Peace, Inc.; Charles L. 










Clark; David Cline; 










James E. Malone; 










John Rowan 










Paul Hackett; 


United States Department of 


E.D. Ky./ 


2:06-cv-00114-WOB 


The Honorable 


Matthew W. Page 


Veterans Affairs; R. James 


Covingto 




WilUam O. 




Nicholson; Gordon G. 


n 




Bertelsman 




Mansfield; John Doe 








Michael Rosato; 


R. James Nicholson 


E.D.N.Y./ 


l:06-cv-03086-ENV- 


The Honorable 


Murry B. Moskowitz; 




Brooklyn 


JMA 


Eric N. Vitaliano 


Bruce Ouellette 
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Dated: July 10, 2006 Respectfully submitted, 

PETER D. KEISLER 

Assistant Attorney General 

ELIZABETH SHAPIRO 

Assistant Branch Director 



/s/ 



ORI LEV 

Senior Trial Counsel 

DAVID M. GLASS 

Senior Trial Counsel 

HEATHER R. PHILLIPS 

Trial Attorney 

U.S. Department of Justice 

Civil Division/Federal Programs Branch 

Mail: P.O. Box 883 

Washington, D.C. 20044 
Street: 20 Massachusetts Ave., N.W. 

Room 7330 

Washington, DC 20001 
Ph: (202) 514-2395 
Fax: (202)318-7589 
Email: ori.lev@usdoj.gov 

Attorneys for Defendants Department of Veterans 
Affairs, Secretary of Veterans Affairs R. James 
Nicholson in his official capacity, Deputy Secretary 
Gordon G. Mansfield in his official capacity, and 
Defendant John Doe in his official capacity. 
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CERTIFICATE OF SERVICE 

I hereby certify that a copy of the foregoing DEFENDANTS DEPARTMENT OF 
VETERANS AFFAIRS, SECRETARY OF VETERANS AFFAIRS R. JAMES 
NICHOLSON, DEPUTY SECRETARY GORDON G. MANSFIELD, AND VA 
EMPLOYEE JOHN DOE'S MOTION FOR TRANSFER AND COORDINATION 
PURSUANT TO 28 U.S.C. § 1407, and accompanying memorandum of law and exhibits were: 

(1) served upon counsel of record for Plaintiffs via first class mail this 10* day of July, 
2006, in the following cases : 

Vietnam Veterans of America, Inc. v. Nicholson, No. l:06-cv-1038-JR 
L. Gray Geddie 
Douglas Rosinksi 

Ogletree, Deakins, Nash, Smoak & Steward, P.C. 
1320 Main Street, Suite 600 
Columbia, South Carolina 29201-3266 

Hackett v. United States Department of Veterans Affairs, Case No. 2:06-cv-l 14-WOB 
Marc D. Mezibov 
401 East Court Street, Suite 600 
Cincinnati, Ohio 45202 

Rosato V. Nicholson, l:06-cv-03086-ENY-JMA 
Joseph H. Weiss 
MarkD. Smillow 
Richard A. Aocelli 
Weiss & Lurie 
55 1 Fifth Avenue 
New York, NY 10179 

(2) filed on July 10", 2006, in the above cited cases, via the courts' electronic case filing 
systems in the Eastern District of Kentucky, the Eastern District of New York, and the District 
for the District of Columbia. 

/s/ 

HEATHER R. PHILLIPS 

Trial Attorney 

U.S. Department of Justice 

Civil Division/Federal Programs Branch 

Mail: P.O. Box 883 

Washington, D.C. 20044 
Street: 20 Massachusetts Ave., N.W. 

Room 7222 

Washington, DC 20001 
Ph: (202) 616-0679; Fax: (202)318-7589 
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BEFORE THE JUDICIAL PANEL 
ON MULTIDISTRICT LITIGATION 



IN RE VA DATA THEFT LITIGATION ) MDL Docket No. _ 

) 



NOTICE OF APPEARANCE 



In compliance with Rule 5.2(c), R.P.J.P.M.L., 199 F.R.D. 425, 431 (2001), the following 
designated attorney is authorized to receive service of all pleadings, notices, orders, and other 
papers relating to practice before the Judicial Panel on Multidistrict Litigation on behalf of 
Defendants Department of Veterans Affairs, Secretary of Veterans Affairs R. James Nicholson in 
his official capacity. Deputy Secretary Gordon G. Mansfield in his official capacity, and 
Defendant John Doe in his official capacity, in the following cases: 

Vietnam Veterans of America, Inc. v. Nicholson, No. l:06-cv-1038-JR 

Hackett v. United States Department of Veterans Affairs, Case No. 2:06-cv- 1 14-WOB 

Rosato V. Nicholson, l:06-cv-03086-ENV-JMA 

I am aware that only one attorney can be designated for each party. 



Date Signature of Attorney 

Name and Address of Designated Attorney: 

HEATHER R. PHILLIPS 

Trial Attorney 

U.S. Department of Justice 

Civil Division/Federal Programs Branch 

Mail: P.O. Box 883 

Washington, D.C. 20044 
Street: 20 Massachusetts Ave., N.W. 

Room 7222 

Washington, DC 20001 
Ph: (202) 616-0679 
Fax: (202)318-7589 



Cas©afe©a-jQ&<13G869iW-MeMyQDodDorannti6HS 3-2 FileeilMrtF/aQro^OOePa^a^eflsef 50 
Case 1:06-cv-01038-JR Document 1 Filed 06/06/2006 Page 1 of 16 



UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



VIETNAM VETERANS OF AMERICA, INC., 
8605 Cameron Street, Suite 400, 
Silver Spring, MD 20910, 

CITIZEN SOLDIER, INC., 
267 Fifth Avenue, Suite 901, 
New York, NY 10016, 

NATIONAL GULF WAR RESOURCE 
CENTER, INC., 

3027 Walnut St., 
Kansas City, MO 64108, 

RADIATED VETERANS OF 
AMERICA, INC., 
2533 N. Carson Street, 
Carson City, Nevada 89706, 

VETERANS FOR PEACE, INC., 
216 South Meramec Ave., 
Saint Louis, MO 63105, 

Charles L. CLARK, 
1245 Akele St., 
Kailua, HI 96734, 

David CLME, 

17 Pierce Avenue #1, 

Jersey City, N J 07307, 

James E. MALONE, 
2002 S. Norton St., 
Tucson, AZ 85713, and 

John ROWAN, 

8605 Cameron Street, Suite 400, 

Silver Spring, MD 20910, 

Plaintiffs, 
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R. James NICHOLSON, in his Official Capacity 
as Secretary of Veterans Affairs, 
810 Vermont Avenue, NW, 
Washington, DC 20420, and 

UNITED STATES DEPARTMENT OF 
VETERANS AFFAIRS, 
810 Vermont Avenue, NW, 
Washington, DC 20420, 

Defendants. 



COMPLAINT 

COME NOW PLAINTIFFS, Vietnam Veterans of America, Inc., Citizen Soldier, Inc., 
National Gulf War Resource Center, Inc., Radiated Veterans of America, lac. Veterans For Peace, 
Inc., Charles. L. Clark, David CHne, James E. Malone, and John Rowan, and in support of their 
Complaint herein allege as follows: 

NATURE OF THE ACTION 

1 . This is an action for declaratory and injunctive reUef and money damages for the 
violations of the Administrative Procedures Act and the Privacy Act of 1974. Plaintiffs represent 
approximately 26,500,000 individuals who have suffered emotional trauma and been placed in fear 
of identity theft, destruction of credit, and jBnancial fraud because of Defendants' reckless disregard 
for the privacy of these citizen's basic personal information. 

2. Defendant Nicholson failed to properly perform the duties of the duties of his position 
as Secretary of Veterans Affairs ("Secretary") and did not ensure Plaintiffs' privacy rights were 
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protected from the intentional, willful, arbitrary and capricious actions and inactions of his 
subordinates. 

3. Defendant United States Department of Veterans Affairs ("Department" or "VA") 
flagrantly disregarded the privacy rights of essentially every living man and woman to have worn a 
United States military uniform, and perhaps others, by illegally maintaining a database of personal 
information unrelated to claims for benefits. 

4. Defendant VA arrogantly compounded it disregard for veterans' privacy rights by 
recklessly failing to make even the most rudimentary effort to safeguard this trove of the personally 
identifiable information from unauthorized disclosure. Thus, the information was unencrypted, 
easily copied, and, apparently, available to anyone aware of its existence. VA's failure, despite 
repeated calls for correction of these long-standing, fundamental security deficiencies, allowed 
millions of citizen's private information to be surreptitiously disclosed to unknown individuals for 
unknown purposes. 

5. The result of Defendants' reckless disregard of Plaintiffs' privacy rights was the 
largest unauthorized disclosure of Social Security numbers in history. 

6. Defendants' actions and inactions have inflicted, and will long continue to inflict, real 
costs and emotional pain and suffering on Plaintiffs and every other living veteran and their famiHes. 

JURISDICTION AND VENUE 

7. Jurisdiction of this Court is invoked pursuant to 28 U.S.C. §'1331 because this is a 
civil action arising under the laws of the United States. Jurisdiction is also invoked pursuant to 5 
U.S.C. §§ 552a(g)(l), (5) because this is a civil action to enforce a liability created under 5 U.S.C. 
§ 552a after September 27, 1975. 



Cas©afe©a-jQ&<13G869iW-MeMyQDodDorannti6HS 3-2 F\\eS\M!im//2m200ePa^s^&i^mi 50 
Case 1 :06-cv-01 038-JR Document 1 Filed 06/06/2006 Page 4 of 1 6 



8. Venue is appropriate in this Court pursuant to 28 U.S. C. § 1391 because a substantial 
part of the events or omissions giving rise to the claims occurred in this district. 

PARTIES 

PLAINTIFFS 

9. Plaintiff Vietnam Veterans of America, Inc. ("VVA") is a Congressionally-chartered 
national veterans' service organization. Many of the group's individual members and their famiUes 
are in receipt of, or are seeking entitlement to, VA benefits. VVA assists disabled veterans and their 
famiUes, both members and non-members, in the prosecution of claims for benefits by providing 
them with j^ra bono legal representation before the VA, the Board of Veterans Appeals and the U.S. 
Court of Appeals for Veterans Claims. VVA's advocacy on behalf of all veterans extends to the 
legislative arena. WA has approximately 53,400 members, all of whom are believed to be 
identified in Defendant's lost records. 

1 0. Plaintiff Citizen Soldier, Inc. is a non-profit active duty military and veterans' rights 
advocacy organization. The organization advocates for the rights of American military veterans and 
active duty personnel over a wide range of issues, including the Agent Orange Utigation. Citizen 
Soldier has also organized educational and advocacy campaigns, via publications and the internet, on 
a range of health and safety issues of concern to veterans. Citizen Soldier currently has 
approximately 7,200 members nationwide, of which approximately 1,500 are military veterans. 

1 1 . Plaintiff National Gulf War Resource Center, Inc. is a national coalition of more than 
twenty Gulf War veterans advocacy groups founded in 1995 to assisting military veterans of 
operations in the Persian Gulf Region from 1990 to the current day. The organization advocates for 
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scientific research and VA medical care and benefits related to the health issues of veterans of 
Persian Gulf conflicts. 

12. Plaintiff Radiated Veterans of America, Inc. is a non-profit organization dedicated to 
advocate for, and aid, past, current and future members of the Armed Forces of the United States of 
America who were or may be exposed to ionizing radiation in fulfilling their duties, their famihes, 
and survivors. Radiated Veterans of America, Inc. has approximately 40 members, essentially all of 
which are military veterans. 

13. Plaintiff Veterans For Peace, Inc. is a national organization of men and women 
veterans of the Spanish Civil War, World War H, Korea, Vietnam, and other conflicts, as well as 
peacetime veterans. The organization has approximately 4,500 veteran members and 1 ,000 associate 
members organized in chapters across the country. 

14. Plaintiff Charles L. Clark is a veteran of World War 11 and a radiation-exposed 
veteran of the occupation of Nagasaki. Plaintiff Clark has submitted claims for VA benefits for the 
adverse health effects caused by his in-service radiation exposure. 

15. Plaintiff David Cline is a disabled Vietnam combat veteran. During his tour of duty 
as a rifleman with the 25* Infantry Division, he was received three Purple Hearts for wounds 
received in combat, the Bronze Star for bravery, the Combat Infantry Badge, and other Vietnam 
service medals. 

16. Plaintiff James E. Malone is cold war veteran who was exposed to radiation fiom 
United States atomic testing. He has filed claims for benefits with VA for service-connected 
conditions. 
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17. Plaintiff John Rowan is the President of Vietnam Veterans of America and a veteran 
of service in the United States Air Force. 

DEFENDANTS 

18. Defendant R. James Nicholson is the Secretary of Veterans Affairs and is the official 
responsible for the proper execution and administration of all laws administered by the Department 
and for the control, direction, and management of the Department. 

19. Defendant VA is an executive department of the federal government and is, therefore, 
an "agency" for purposes of the Privacy Act of 1974. 

STATEMENT OF THE FACTS 

20. On May 3, 2006, a laptop computer and external data storage device or devices were 

reported stolen from the home of a VA employee. The laptop computer and data storage device or 
devices contained a copy of a collection or grouping of information pertaining to approximately 26.5 
million persons (the "Personal Information"), including military veterans and their spouses. The 
Personal Information contained individual identifying information including, but not limited to, 
names, addresses, phone numbers, social security numbers, and dates of birth. In addition, an 
unknown number of individual's records contained disability information and information related to 
possible exposure to biological and chemical agents. None of the information was encrypted or 
similarly protected. 

2 1 . The incident was the largest unauthorized disclosure of Social Security data ever. The 
disclosure was so patently egregious and unlawful that any reasonable government official would 
have known it to be unlawful. 
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22. The VA employee reported the Personal Information theft to one or more VA 
officials. These VA officials were aware of the egregious and unlawful disclosure of the Personal 
Information soon after the occurrence, yet these VA officials willfully and intentionally decided to 
conceal the disclosure and did not to report the incident to other VA official, federal law 
enforcement, or inform the individuals whose personal information had been disclosed without 
authorization. These failures exhibit Defendants' reckless disregard for Plaintiffs' privacy rights, 
intentional and willful violations of the Privacy Act, and were otherwise not in accordance with law. 

23. No VA official charged with protecting the Personal Information pursuant to the 
Privacy Act and who was knowledgeable of the egregious and unauthorized disclosure informed 
Defendant VA's Inspector General of the disclosure. The Inspector General only learned of the 
incident through an offhand remark on May 10, 2006. Then, the Inspector General further 
demonstrated VA's reckless disregard for Plaintiffs' privacy rights and intentional and willful 
disregard for Privacy Act requirements by failing to interview the employee in question until May 
15, 2006, five days later. 

24. Defendant Nicholson was informed of the patently egregious and unlawful disclosure 
on May 16, 2006, but the Federal Bureau of Investigation ("FBF') was not contacted until May 17, 
2006. Defendant Nicholson did not publicly inform Plaintiffs or any other individuals of VA's 
egregious and patently unlawful disclosure of the Personal Information until May 22, 2006, 1 9 days 
after the reported theft. Contrary to Defendant Nicholson's/»o5f hoc public statements this delay was 
not a result of a premeditated plan to avoid public concern, but actually resulted jfrom Defendants 
VA's officials' reckless disregard for Plaintiffs' privacy rights and failure to promptly and 
forthrightly report the disclosure or otherwise observe the procedures required by law. 
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25. Defendants' actions and inactions in failing to report the unauthorized disclosure of 
the Personal Information were arbitrary, capricious and without observance of procedures required 
by law. 

26. Defendant VA has been repeatedly informed of recurring, systemic, and fundamental 
deficiencies in its information security, but failed to effectively respond. VA's own Inspector 
General has for years criticized the Department for lax information security. Despite the repeated 
identification of problems, VA has been unable or unwilling to properly secure the personal 
information under its control. These repeated failures to correct known vulnerabilities of VA's 
safeguards for Plaintiffs' private information demonstrated a reckless disregard for privacy rights and 
intentional or willful violations of the Privacy Act. 

27. The VA employee who reported the laptop computer stolen routinely took sensitive 
private information, including the Personal Infonnation, home since at least 2003. The employee 
had not received a security background check for approximately 32 years. 

28. The Personal Information disclosed on May 3 , 2006, could be retrieved by the name 
of an individual or by some identifying number, symbol, or other identifying particular assigned to an 
individual. 

29. VA flagrantly disregarded Plaintiffs privacy and caused Plaintiffs adverse effects by 
not obtaining prior written consent of Plaintiffs, or any individual, before disclosing the Personal 
Information to any other individual or government agency. 

3 0. V A flagrantly disregarded Plaintiffs ' privacy and caused Plaintiffs ' adverse effects by 
failing to observe the procedures required by law for disclosure of private information, including the 
Personal Information, without the prior written consent of the affected individuals. 
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3 1 . VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
disclosing, or allowed disclosure of, the Personal Information to officials and employees who did not 
have a need for such records and information in the performance of their duties. 

32. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to keep or maintain an accurate accounting of the disclosures of the Personal Information. 

33. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects 
assembling and maintaining the Personal Information in a system of records although the information 
was not relevant and necessary to accompUsh a purpose required by statute or by executive order of 
the President. 

34. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to collect the Personal Information directly firom the subject individuals to the greatest extent 
practicable although the information may result in adverse determinations about an individual's 
rights, benefits, and privileges under a Federal program. 

35. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to publish a notice of the existence and character of the Personal Information system of 
records in the Federal Register. 

36. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to make reasonable efforts to assure that the Personal Information records were accurate, 
complete, timely, and relevant for VA purposes prior to disseminating a record about an individual to 
any person other than an agency. 

37. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to estabHsh or implement appropriate administrative, technical, and physical safeguards to 
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insure the security and confidentiality of records and to protect against anticipated threats or hazards 
to the records security or integrity, which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information was maintained. VA' s security 
deficiencies allowed, and continue to allow, a single individual to compromise through disclosure the 
entire Personal Information system of records. VA's entrenched unwillingness or inabihty to 
establish and maintain adequate information security is an abuse of discretion and an intentional and 
willfiil failure to observe procedures required by law. 

38. Defendant Nicholson was ultimately responsible for control, direction, and 
management of VA's processes, policies, and procedures for compliance with the Privacy Act of 
1974, including, but not limited to VA Handbook 6300.5, "Procedures for Establishing and 
Managing Privacy Act Systems of Records," but failed to ensure those processes, pohcies, and 
procedures were adequately implemented by his subordinates. Defendant Nicholson knew, or should 
have known, that VA had long-standing information security deficiencies that threatened Plaintiffs' 
privacy rights, but did not ensure correction or mitigation of those deficiencies. 

39. Defendant Nicholson flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' 
adverse effects by failing to estabUsh and ensure lawful compliance by his subordinates with 
appropriate administrative, technical, and physical safeguards to insure the security and 
confidentiality of records and to protect against anticipated threats or hazards to the records security 
or integrity, which could result in substantial harm, embarrassment, inconvenience, or unfairness to 
any individual on whom information was maintained. 
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40. Each of Defendants' failures complained of caused Plaintiffs adverse effects 
including, but not limited to, embarrassment, inconvenience, unfairness, mental distress, emotional 
trauma, pecuniary damages and the threat of current and future substantial harm from identity theft. 

4 1 . The real threat of identity theft and similar adverse effects of VA's illegal actions and 
inactions Privacy Act violations requires affirmative actions by Plaintiffs to recover peace of mind, 
emotional stability, and personal security including, but not limited to, frequently obtaining and 
reviewing credit reports, bank statements, and other similar information, obtaining credit watch 
services, and closing financial accounts. Plaintiffs have, and will continue to, suffer tangible and 
intangible damages for the foreseeable future. 

CLASS ACTION ALLEGATIONS 

42. This action is maintainable as a class action pursuant to Federal Rules of Civil 
Procedure 23(a), (b)(l)-(3). 

43 . The class consists of all persons who have been adversely effected by Defendants' 
APA and Privacy Act violations. 

44. The class is so numerous that joinder of all members is impractible. The class siz.e is 
approximately 26,500,000, which is the number of individuals whose information Defendants admit 
was collected and maintained in the missing system of records. 

45. Joinder of class members' individual actions is impractical because of the 
geographical diversity of class members, the limited ability of individual class members to institute 
separate suits, and the general nature of the underlying action and relief sought. 

46. Class representatives' counsel, Ogletree, Deakins, Nash, Smoak & Stewart, P.C. is 
appropriately qualified and experienced to represent the class. 

11 
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47. There are substantial questions of fact and law common to all class members. The 
legal issues raised in this Complaint are limited to violations of the APA and Privacy Act. The 
factual issues of whether Defendants violated one or more legal requirements are common to all 
class members. Similarly, the relief Plaintiffs seek is dominated by equitable remedies. The facts, 
circumstances, and merits of the case, therefore, apply equally to all class members. 

48. The claims of the representative Plaintiffs are typical of the claims of the class 
members. Representative Plaintiffs are military veterans listed in one or more VA system of records 
who have had their personal information improperly maintained and disclosed by Defendants. 

49. The representative Plaintiffs will fairly and adequately protect the interests of the 
class. Several Plaintiffs have previously come forward, at their own expense, to publicly raise the 
issue of Defendants' conduct. Furthermore, the representative Plaintiffs' claims span the breadth of 
issues raised in this action. 

50. Defendants have acted and refused to act on grounds generally applicable to the class, 
making appropriate final injunctive and declaratory relief with respect to the class as a whole. 

5 1 . The prosecution of separate actions by individual class members would create a risk 
of inconsistent results that could establish incompatible standards of conduct for Defendants. 

52. Defendants' liability for damages can be established by facts and circumstances 
common to the class as a whole and do not require the examination of Plaintiffs' individual 
circumstances. 

53. Questions of law and fact common to members of the class predominate over any 
questions affecting only individual members. 
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54. A class action is superior in this case to other methods for a fair and efficient 
adjudication of the controversy because: (A) the common interests of the class members 
predominate over any individual interest in controlling prosecution or control of separate actions; 
(B) no similar litigation concerning the controversy is known to have been commenced by members 
of the class; (C) concentrating litigation of this action in this Court is appropriate to ensure 
appropriate, consistent, and efficient resolution of the constitutional issues raised in the district 
where the offending conduct occurred, continues to occur, and could occur in the future; and (D) the 
difficulties in managing an action involving this class are significantly reduced by existing databases 
of potential class members prepared by the government and veteran service organizations. 

FIRST CLAIM FOR RELIEF 

Violation of the Administrative Procedures Act 

55. Plaintiffs reassert their allegations set forth in Paragraphs (1) through (54) above and 
incorporate them by reference into this First Claim for Rehef. 

56. Defendant VA possesses personal information of Plaintiffs and milhons of other 
veterans and citizens. VA has repeatedly demonstrated an inability or unwillingness to implement, 
or callous disregard for, fundamental procedures to provide minimally acceptable safeguards for the 
personal and private information in its possession. 

57. Defendant Nicholson is ultimately responsible in his official capacity for safeguarding 
citizen's private information under VA control pursuant to appHcable laws, including the Privacy Act 
of 1974 and the Administrative Procedures Act, but has been unable or unwilling to require 
compliance with those laws. 
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58. Defendants' actions and inactions in failing to safeguard Plaintiffs' private 
information were arbitrary, capricious, and otherwise not in accordance with law. 

59. Plaintiffs suffered, and continue to suffer, harm as a result of Defendants' actions and 
from actions improperly withheld or unreasonably delayed. 

60. Plaintiffs are entitled to equitable relief for Defendants' violation of Plaintiffs' rights 
pursuant to the Administrative Procedures Act. 

SECOND CLAIM FOR RELIEF 

Violation of the Privacy Act 

61 . Plaintiffs reassert their allegations set forth in Paragraphs (1) through (60) above and 
incorporate them by reference into this Second Claim for Relief 

62. Defendants violated the Privacy Act of 1 974. 

63. Each of Defendants' violations of the Privacy Act was intentional or willful. 

64. Each of Defendants' Privacy Act violations caused Plaintiffs adverse effects. 

65. Defendants' unauthorized disclosure of individuals' names, addresses, and phone 
numbers linked to their Social Security numbers has, in particular, placed each Plaintiff in legitimate 
fear of identity theft, corruption of their credit files, and plundering of bank accounts and retirement 
flinds. 

66. Plaintiffs suffered actual damages as a result of Defendants' Privacy Act violations. 

67. Plaintiffs are entitled to monetary rehef and the costs of this action together with 
reasonable attorney fees. 



Ca^3km--mQ3Gmmmf3M/^o6Diamm6p&3-2F\\emM!im//2m200ePa^ai^6mQi50 
Case 1:06-cv-01038-JR Document 1 Filed 06/06/2006 Page 15 of 16 



PRAYER FOR RELIEF 

WHEREFORE, Plaintiffs pray as follows: 

(a) That this Court issue a declaratory judgment that Defendants violated, and continue 
to violate, Plaintiffs' rights under the Administrative Procedures Act and Privacy Act 
of 1974; 

(b) That this Court order Defendant Nicholson to immediately identify in the Federal 
Register the existence and character of every system of records maintained by VA 
and make available to any individual therein, their authorized representatives, or 
survivors, each record maintained in any VA system of records pertaining to that 
individual; 

(c) That this Court order Defendant Nicholson to immediately identify in the Federal 
Register each use of every system of records, including any vise of that system or 
individuals records thereof knovrai as a "project" or "projects," and the exphcit 
statutory or other legal basis for that use or project; 

(d) That this Court permanently enjoin Defendant VA, its officers, agents, employees, 
and those acting for and with them, from accessing, viewing, handling, disclosing, or 
in any way transferring any record or system of records subject to Privacy Act 
requirements until an independent panel of experts finds that adequate information 
security has been established and implemented by VA, unless such activity is 
exphcitly allowed by Court order and under supervision of persons independent of 
VA, such supervision to be at VA expense; 
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(e) That this Court enjoin Defendant VA, its officers, agents, employees, and those 
acting for and with them from removing any device capable of storing, containing, or 
transferring any record or system of records, including, but not limited to, laptop 
computers, portable hard drives, memory stick or similar devices, and "iPods" and 
similar devices, from property under VA's supervision and control until and unless 
VA demonstrates that adequate information security has been estabUshed to the 
Court's satisfaction. 

(f) That this Court grant to Plaintiffs judgment against Defendant VA for damages in an 
amoimt of $ 1 ,000.00 for each individual w^ho was adversely affected by Defendant' s 
Privacy Act violations; 

(g) That this Court grant to Plaintiffs their costs and reasonable attorney's fees; and 
(h) That this Court grant such additional rehef as the Court deems proper and just. 

Respectfully submitted. 




•^L. G^ld^e (D.C. Bar No. 421357) 
Douglas^fTRosinski (D.C. Bar No. 461275) 
Ogletree, Deakins, Nash, 

Smoak & Stewart, P.C. 
1320 Main St. 
Columbia, SC 29201-3266 
Attorneys for Plaintiffs 



DATED: June 6, 2006 
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United States District Court 



EASTERN 



MICHAEL ROSATO, MURRY B. MOSKOWITZ, 
and BRUCE QUELLETTE, on their own behalf 
and on behalf of all others similarly situated, 

V. 

R. JAMES NICHOLSON, in his Official Capadty 

as Secretary of Veterans Affairs, 810 Vermont 

Avenue, NW., (see attachment) 



SUMMONS IN A CIVIL ACTION 

^j 06 SOS 6 



TO: (Name and address of Defendant) 



AZRACK,J. 



R. James Nicholson, in hi§ Official Capacity as Secretary of Veterans 
Affairs and United States Department of Veterans Affairs, 810 Vermont 
Avenue, NW, Washington, DC 20420 



YOU ARE HEREBY SUMMONED and required to serve on PLAINTIFF'S ATTORNEY (name and address) 



WEISS & LURIE 
551 Fifth Avenue 
New York, New York 1 01 76 



an answer to the complaint which is served on you with this summons, within 20 days after service 

of this summons on you, exclusive of the day of service. If you fail to do so, judgment by default will be taken against you 
for the relief demanded in the complaint. Any answer that you serve on the parties to this action must be filed with, the 
Clerk of this Court within a reasonable period of time ailer service. 



^omwf ^'- ^mwMM^ 



■ jlTM 9 1 fHfii^ 



j^ 



BPUTY CLERK 



^>t->^ , 
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EXHIBIT 
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CrVIL ACTION NO. 

VITALIANO, 4« 



AZRACrtp - ^ 



JURY TRIAL DEM^SteED 



UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 

MICHAEL ROSATO, MURRY B. MOSKOWTTZ, 
and BRUCE OUELLETTE, on their own behalf and 
on behalf of all others similarly situated, 

Plaintiffs, 



R. JAMES NICHOLSON, in his Official Capacity 
as Secretary of Veterans Affairs, 
81 Vermont Avenue, NW, 
Washington, DC 20420, and 

UNITED STATES DEPARTMENT OF 
VETERANS AFFAIRS, 
8 1 Vermont Avenue, NW, 
Washington, DC 20420, 

Defendants. 



COME NOW PLAINTIFFS, Michael Rosato, Murry B. Moskowitz and Bruce Ouellette, 
and in support of their Complaint herein allege as follows: 

NATURE OF THE ACTION 

1 . This is a class action for declaratory and injunctive relief and money damages for 
the violations of the Administrative Procedures Act and the Privacy Act of 1 974 and the Fourth 
and Fifth Amendments to the United States Constitution under the authority ofBivens v. Six 
Unknown Named Agents of the Federal Bureau of Narcotics, 403 U.S. 388 (1971). Plaintiffs 
represent approximately 26.5 million individuals who are both veterans and active service 
members of the Armed Services of the United States who have suffered emotional trauma, have 
been placed in fear of identity theft, destruction of credit and financial fi-aud, and who have had 
their private and personal health care information compromised because of Defendants' 



T1 



o 



intentional, willfiil and reckless disregard for the security and privacy of these citizens' basic 
personal information. 

2. Defendant Nicholson failed to properly perform the duties of his position as 
Secretary of Veterans Affairs ("Secretary") and did not protect the privacy rights of Plaintiffs and 
the other class members and failed to institute and enforce procedures mandated by law for the 
protection of veterans' and service members' private and personal information. 

3 . Defendant United States Department of Veterans Affairs ("Department" or "VA") 
also did not assure that class members' privacy rights were protected, failed to institute and 
enforce procedures mandated by law for the protection of veterans' and service members' private 
and personal information, and flagrantly disregarded the privacy rights of virtually all armed 
service members by illegally maintaining a database.of personal information unrelated to claims 
for benefits and by requiring that veterans' and service members' records be maintained and 
accessed through their individual, private and personal social security numbers or other 
identifiers that were required by law to be kept confidential. 

4. Defendants compounded their disregard for veterans' and service members' 
privacy rights by recklessly failing to make even the most rudimentary effort to safeguard this 
trove of personally identifiable information from unauthorized disclosure. In fact, the 
information was unencrypted, easily copied, and, apparently, available to anyone aware of its 
existence. Defendants' failures, despite repeated calls for correction of these long-standing, 
fundamental security deficiencies, allowed millions of citizens' private information to be 
compromised and disclosed to unknown individuals for unknown purposes. 

5. Defendants improperly, unlawfully, willfully and intentionally disclosed the 
private and personal information of Plaintiffs and the Class in at least three ways: (1) through 
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VA employees' improper access and removal of data files containing the private personal 
information of 26.5 million veterans and active service members from the VA; (2) through the 
transfer by VA personnel of the data to external and unprotected disks and/or computers; and (3) 
through the alleged theft of these disks and/or computers by a third party or parties, whose 
identity may never be known. 

6 . The result of Defendants ' reckless disregard of the privacy rights of the Class was 
the largest unauthorized disclosure of Social Security niimbers, addresses, telephone numbers 
and health information in history. 

7. Defendants' actions and inactions have inflicted serious harm and will continue to 
inflict real costs and emotional pain and suffering on Plaintiffs and every other living veteran and 
their families whose identities and other personal and private information have been 
compromised. 

8. Defendants' willful and intentional failure to establish and enforce appropriate 
safeguards to ensure the security and privacy of veteran records and to protect against any known 
or anticipated threats or hazards to the security and integrity of these records is in violation of 5 
U.S.C. § 552a(e)(10) and other laws. Furthermore, subsequent to learning of the foregoing 
unauthorized disclosures, Defendants were deliberately indifferent in failing to take reasonable 
corrective action, including but not limited to, providing prompt and accurate notification of the 
disclosures to law enforcement and the affected veterans despite knowledge of the substantial 
risk of serious harm to the personal and financial security of the affected veterans as result of the 
disclosures. 
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JURISDICTION AND VENUE 

9. Jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1 33 1 because this is 
a civil action arising under the laws of the United States. Jurisdiction is also invoked pursuant to 
5 U.S.C. §§ 552a(g)(5) because this is a civil action to enforce a liability created under 5 U.S.C. 

§ 552a after September 27, 1975. 

10. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C. § 1391(e)! 

1 1 . Plaintiff Michael Rosato is a veteran of the United States Armed Services 
honorably discharged from service. He is a resident of Suffolk County, New York. 

12. Plaintiff Murry B. Moskowitz is a veteran of the United States Armed Services 
honorably discharged from service. He is a resident of Fairfax County, Virginia. 

1 3 . Plaintiff Bruce Ouellette is a disabled Vietnam combat veteran and a current 
resident of Yavapai County, Arizona. 

14. Defendant R. James Nicholson is the Secretary of Veterans Affairs and is the 
official responsible for the proper execution and administration of all laws administered by the 
Department and for the control, direction, and management of the Department. 

1 5. Defendant VA is an executive department of the federal government and is, 
therefore, an "agency" for purposes of the Privacy Act of 1974. 

STATEMENT OF FACTS 

1 6. Upon information and belief, VA employees were able to easily access computer 
files containing private Personal Information of millions of veterans and copy the files from the 
VA's system onto external disks and their personal computers. Upon further information and 
belief, VA employees had, in fact, been removing the data from the VA facility for a period of 
three years in a practice expressly or implicitly ratified by the VA. VA employees' access to and 

4 
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duplication of this information was a disclosure in violation of 5 U.S.C. 552a(b) and the result of 
Defendants' willful and intentional failure to establish appropriate safeguards to ensure the 
security and confidentiality of veteran records and to protect against any anticipated threats or 
hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

1 7. On May 3, 2006, a laptop computer and external data storage device or devices 
were reportedly stolen from the Aspen Hill, Maryland home of John Doe, a VA employee. The 
laptop computer and data storage device or devices contained a copy of a collection or grouping 
of information pertaining to approximately 26.5 million persons (the 'Tersonal Information"), 
including military veterans and approximately 2.2 million current active service members and 
their spouses (or nearly 80 percent of the active duty force). The Personal Information contained 
individual identifying information including, but not limited to, names, addresses, phone 
nximbers, social security numbers, dates of birth and health information. In addition, at least 
three hundred of the records contained disability information and information related to possible 
exposure to biological and chemical agents. None of tide information was encrypted or similarly 
protected. 

1 8. Upon information and belief, John Doe had removed tihe VA files containing the 
private personal information of 26.5 million veterans from the VA facility and taken it to his 
home shortly before the theft described in the prior paragraph. John Doe then copied the files 
onto his computer and/or external disks for an unspecified purpose, John Doe's computer and/or 
disks were allegedly stolen during a burglary of his home. Upon infonnation and belief, these 
items have not been recovered as of the date of the filing of this Complaint. They were not 
encrypted or password protected and are easily accessed and duplicated. 
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19. John Doe reported the Personal Infonnation theft to one or more VA officials. 
These VA officials were aware of the unlawful disclosure of the Personal Informatioh soon after 
the occurrence, yet these VA officials willfully and intentionally decided to conceal the 
disclosure and did not report the incident to other VA officials, federal law enforcement, or 
inform the individuals whose Personal Information had been disclosed without authorization. 
These failures exhibit Defendants' reckless disregard for Plaintiffs' privacy rights, intentional 
and willful violations of the Privacy Act, and were otherwise not in accordance with law. 

20. No VA official charged with protecting the Personal Information pursuant to the 
Privacy Act and who knew of the unauthorized disclosure informed Defendant VA's Inspector 
General George Opfer of the disclosure. The Inspector General only learned of the incident 
through an offhand remark on May 10, 2006. Then, the Inspector General further demonstrated 
VA's reckless disregard for the privacy ri^ts of Plaintiffs and the Class and an intentional and 
willful disregard for Privacy Act requirements by failing to interview the employee in question 
until May 15, 2006, five days later. 

2 1 . Defendant Nicholson was informed of the patently unlawful disclosure on May 
16, 2006, and the Federal Bureau of Investigation ("FBI") was contacted on May 17, 2006. 
Defendant Nicholson did not publicly inform Plaintiffs or any other individuals of VA's patently 
unlawful disclosure of the Personal Information until May 22, 2006, 19 days after the reported 
theft. 

22. Defendants* actions and inactions in failing to report the tmauthorized disclosure 
of the Personal Momiation were arbitrary, capricious and without observance of procedures 
required by law. 



Ca^3^m--mQ3Gmmmif^M/^o(Sicimm6m3-2F\\eE\\^W/2m200ePa^^(2^m^50 



23 . Defendant VA has been repeatedly informed of recurring, systemic, and 
fundamental deficiencies in its information security, but failed to effectively respond. VA's own 
Inspector General has for years criticized the Department for lax information security. Despite 
the repeated identification of problems, VA has been unable or unwilling to properly secure the 
personal information under its control. These repeated failures to correct known vulnerabilities 
of VA's safeguards for Plaintiffs' and class members' Personal Information demonstrated a 
reckless disregard for privacy rights and intentional or willful violations of the Privacy Act. 

24. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to observe the procedures required by law for disclosure of private 
information, including the Personal Information, without the prior written consent of the affected 
individuals. 

25. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by disclosing, or allowing disclosure of, the Personal Information to officials and 
employees who did not have a need for such records and information in the performance of their 
duties. 

26. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to keep or maintain an accurate accounting of the disclosures of the 
Personal Information. 

27. VA also flagrantly disregarded the privacy of Plaintiffs and the Class and caused 
them adverse effects by assembhng and maintaining the Personal Information in a system of 
records although the information was not relevant and necessary to accomplish a purpose 
required by statute or by executive order of the President. 
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28. Defendants knew or should have known that their computer security practices 

were not in compliance with 5 U.S.C. § 552a as well as other federal laws relating to information 

security. In 2003, a study conducted by the General Accounting Office ("GAO") gave the VA a 

failing grade for its computer security practices. In March 2006, the United States House of 

Representative's Committee on Government Reform gave the VA an "F" in its annual report 

card relating to information security. Despite this ample and specific notice of noncompliance 

and the potential adverse effect of random and unauthorized disclosures of Personal Information, 

Defendants failed to establish appropriate safeguards to ensure the security and confidentiality of 

veteran records and to protect against any anticipated threats or hazards to the security and 

integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

29. An Associated Press article published on June 14, 2006, concerning that day's 

testimony in Congressional hearings on the compromise of privacy laws at the VA, reported: 

In testimony to Congress, the Government Accountability Office and Veterans 
inspector general detailed ignored warnings, weak management and lax rules in 
their review of VA information security following the theft of 26.5 million 
military personnel's private data last month. 

They found that the Veterans Affairs Department routinely failed to control and 
monitor employee access to private information, did not restrict xisers to "need-to- 
know" data and often waited too long to terminate accounts when an employee 
quit or was fired. 

The investigators also said the VA lacked a clear chain of command in enforcing 
security, noting the agency will need dramatically stronger leadership under VA 
Secretary Jim Nicholson to force reform after five years of repeated warnings 
about security. 

"Much work remains to be done," Linda Koontz, a director on information 
management at GAO, told the House Veterans Affairs Committee. "Only through 
strong leadership, sustained management commitment and effort, disciplined 
processes, and consistent oversight can VA address its persistent, long-standing 
control weaknesses." 
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30. The testimony of June 14 made clear, according to the foregoing article, that: 

government investigators said the problem was long-standing and much more 
widespread. They pointed to repeated occasions in the last year in which VA 
employees passed along veterans' medical information via unencrypted e-mail or 
were allowed to freely log into the VA secure network in their off-duty hours or 
even after they've been terminated. 

In other instances, files were not adequately segregated or password-protected, 
making it easy for hackers to access the sensitive information. 

3 1 . Finally, the article underscored the fact that the defendants were aware of their 

privacy laws deficiencies for a very long time. 

When the VA was told of problems over the years, often it would make spotty 
improvements but fail to address reform agency-wide. The agency also has yet to 
put in place a security response program to monitor suspicious log-on activity, 
said Michael Staley, an assistant VA inq)ector general, in testimony. 

"These conditions place sensitive information, including financial data and 
sensitive veteran medical and benefit information, at risk, possibly without 
detection of inadvertent or deliberate misuse, fraudulent use, improper disclosure 
or destruction," Staley said. 

32. The unauthorized and unconsented disclosure of an individual's name, address, 
date of birth, health and/or disability status and Social Security number creates a substantial risk 
of identity theft and an invasion of privacy. An individual's Social Security number is the most 
useftil identifier for retrieving information from public record databases, financial institutions 
and credit bureaus. Armed with an individual's name, address, date of birth and Social Security 
number, an identity thief is able to quickly and easily steal an identity, whereas, without such 
information, the task is difficult, time consuming and costly. Moreover, the unauthorized 
disclosure of an individual's health or disability status invades the privacy of information 
protected under law. 
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33. Recent nationwide studies confirai that, on average, victims of identity theft spend 
hundreds of hours in personal'time and hundreds of dollars in personal ftinds to resolve their 
caredit issues. See www.idtheftcenter.org; www.ftctorg. 

34. Defendants' unauthorized and unconsented disclosures of private Personal 
Information and the imminent and substantial risk of identity theft to which the Class has been 
exposed is the direct result of Defendants' failure to: (1) establish appropriate administrative, 
technical and physical safeguards to ensure the security and confidentiality of records; (2) to 
protect against any anticipated threats or hazards to the security and integrity of these records; 
and (3) to promptly take reasonable measures to correct the disclosures, including but not limited 
to, providing law enforcement and the affected veterans with prompt and accxirate notice of the 
disclosures, and free ongoing monitoring of class members' health and financial reports. 

35. As a direct and proximate result of Defendants' acts and omissions, the Class has 
been exposed to a risk of substantial harm and inconvenience, and has incurred actual damages in 
purchasing comprehensive credit reports and/or monitoring of their identity and credit. 
Furthermore, their individual privacy has been invaded through the disclosure of their private and 
personal health information. 

36. Defendant Nicholson was ultimately responsible for control, direction, and 
management of VA's processes, policies, and procedures for compliance with the Privacy Act of 
1 974 and other privacy laws, rules and regulations, but failed to ensure those processes, policies, 
and procedures were adequately implemented by his subordinates. Defendant Nicholson knew, 
or should have known, that VA had long-standing inforaiation security deficiencies that 
threatened the privacy rights of Plaintiffs and the Class, but did not ensure correction or • 
mitigation of those deficiencies. 
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3 7. Defendant Nicholson flagrantly disregarded the privacy rights of Plaintiffs and the 
Class and caused them adverse effects by failing to establish and ensiure lawful conapliance by his 
subordinates with appropriate administrative, technical, and physical safeguards to insure the 
security and confidentiality of records and to protect against anticipated threats or hazards to the 
records security or integrity, which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information was maintained. 

38. . Each of Defendants' failures complained of caused adverse effects to the Class 
including, but not limited to, embarrassment, inconvenience, unfairness, mental distress, 
emotional trauma, pecuniary damages and the threat of current and future substantial harm from 
identity theft. In testimony to Congress on or about June 12, 2006, Defendant Nicholson said 
that although he remained hopefiil that the theft from the VA employee in Maryland was random, 
he and the VA could not count on the fact that no use of the stolen data was or would be made by 
unauthorized persons. 

39. The real threat of identity theft and similar adverse effects of VA's illegal actions 
and Privacy Act violations requires affirmative actions by the Class to recover peace of mind, 
emotional stability, and personal security including, but not limited to, frequently obtaining and 
reviewing credit reports, bank statements, and other similar information, obtaining credit watch 
services, and closing financial accounts. The Class has, and will continue to, suffer tangible and 
intangible damages for the foreseeable future. 

40. In Congressional hearings held after the disclosure of the Personal Information 
discussed herein, Representative Henry Waxman of California berated defendant Nicholson for 
his conduct and malfeasance: 
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"Secretary Nicholson, you blame this on an employee who was fired, on a culture, 
on people doing what they're not supposed to be doing. That doesn't sound like 
we're getting to the heart of this witfi passing the buck." 

CLASS ACTION ALLEGATIONS 

41 . This action is maintainable as a class action pursuant to Federal Rules of Civil 
Procedure 23(a) and (b)(l)-(3). 

42. The Class consists of all persons who have been adversely effected by 
Defendants' violations of the privacy of class members' personal and private identifying 
information. 

43. This action is properly maintainable as a class action for the following reasons: 

a. The Class is so numerous thatjoinderofall members is impractible. The 
class size is approximately 26,500,000, which is the number of individuals whose information 
Defendants admit was collected and maintained in the missing system of records. 

b . Joinder of class members * individual actions is impractical because of the 
geographical diversity of class members, the limited ability of individual class members to 
institute separate suits, and the general nature of the underlying action and relief sought. 

c. Plaintiffs are committed to the vigorous prosecution of this action and 
have retained counsel qualified and experienced to represent the Class and familiar with class 
litigation. Plaintiffs' claims are typical of the claims of other members of the Class and plaintiffs 
have no interest that are adverse or antagonistic to the interests of the Class. Plaintiffs are 
military veterans listed in one or more VA system of records who have had their personal 
infoimation improperly maintained and disclosed by Defendants. 

d. The representative Plaintiffs will fairly and. adequately protect the interests 
of the Class. 
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e. There are substantial questions of fact and law conimon to all class 
members. The issues raised include whether Defendants acted or failed to act conamensurate 
with their duties to protect the personal, private and confidential information of Plaintiffs and 
class members, whether such conduct violated the privacy and other laws, whether said 
violations were willfiil, wanton and/or reckless and whether such conduct gives rise to the 
various forms of relief requested and/or damages. The foregoing issues are common to all class 
members. Similarly, the relief Plaintiffs seek is dominated by equitable remedies. The facts, 
circumstances, and merits of the case, therefore, apply equally to all class members. 

f. Defendants have acted and refused to act on grotmds generally appHcable 
to the Class, making approprijate final injunctive and declaratory relief with respect to the Class 
as a whole. 

g. The prosecution of separate actions by individual class members would 
create a risk of inconsistent results that could establish incompatible standards of conduct for 
Defendants. 

h. Defendants' liability for damages can be established by facts and 
circumstances common to the Class as a whole and do not require the examination of Plaintiffs' 
individual circumstances. 

1. Questions of law and fact common to members of the Class predominate 

over any questions affecting only individual members. 

j. A class action is superior in this case to other methods for a fair and 

efficient adjudication of the controversy because the common interests of the class members 
predominate over any individual interest in controlling prosecution or control of separate actions 
and because concentrating the litigation in this Court is appropriate to ensure appropriate, 

13 
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consistent, and efficient resolution of the legal and constitutional issues raised in the district 
where the offending conduct occurred, continues to occur, and could occur in the ftiture. 
FIRST CLAIM FOR RELIEF 

44. Plaintiffs reassert the allegations set forth in Paragraphs 1 through 43 above and 
incorporate them by reference into this First Claim for Relief 

45. Defendant VA possesses personal information of Plaintiffs and millions of other 
veterans and active service members. VA has repeatedly demonstrated an inability or 
unwillingness to implement, or callous disregard for, fundamental procedures to provide 
minimally acceptable safeguards for the personal and private information in its possession. 

46. Defendant Nicholson is ultimately responsible in his official capacity for 
safeguarding citizen's private information under VA control pxirsuant to applicable laws, 
including the Privacy Act of 1974 and the Administrative Procedures Act, but has been unable or 
unwilling to require compliance with those laws. 

47. Defendants' actions and inactions in failing to safeguard Plaintiffs' private 
information were arbitrary, capricious, and otherwise not in accordance with law. 

48. Plaintiffs suffered, and continue to suffer, harm as a result of Defendants' actions 
and from actions improperly withheld or unreasonably delayed. 

49. The Class is entitled to monetary and equitable relief for Defendants' violation of 
plaintiffs' rights pursuant to the Administrative Procedures Act. 

50. The foregoing acts and omissions of Defendant VA constitute an xmauthorized, 
nonconsensual, and inappropriate disclosure of Social Security numbers and private health 
information of the Class in violation of 5 U.S.C. § 552a(b). 
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SECOND CLAM FOR RELIEF 

5 1 . Plaintiffs repeat and reafBrm the assertions of fact contained in paragraphs 1 
through 50 hereinabove. 

52. The foregoing acts and omissions of Defendant VA constitute a willful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of the private personal records of the Class in violation of 5 U.S.C. § 552a(e)(10). 

THIRD CLAIM FOR RELIEF 

53. Plaintiffs repeat and reaffirm the assertions of fact contained in paragraphs 1 
through 52 hereinabove. 

54. The foregoing acts and omissions of Defendants constitute a violation of the right 
to privacy and personal security of the Class in their Social Security numbers and private health 
information under the Fourth and Fifth Amendments to the United States Constitution. 

PRAY FOR RELIEF 
WHEREFORE, Plaintiffs pray as follows: 

a. For a declaration that Defendants' acts and omissions constitute a willful 
and intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran and active service member records and to protect against known and anticipated threats 
or hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10) and 
the Fourth and Fifth Amendments of the United States Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting and 
preventing Defendants from continuing to operate without appropriate safeguards to ensure the 
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secxirity and privacy of veteran records and to protect against anticipated threats or hazards to the 
security and integrity of these records. 

c. For reparative injunctive relief under Bivens requiring Defendants to taJce 
necessary measures to safeguard against the serious harm attendant to the improper 
disclosure/theft of confidential information including an identity and/or credit monitoring 
program and a preemptive internet search service for the benefit of Plaintiffs and the proposed 
Class under the Coxirt's supervision; 

d. That this Court permaneaitly enjoin Defendant VA, its officers, agents, 
employees, and those acting for and with them, fi"om accessing, viewing, handling, disclosing, or 
in any way transferring any record or systfem of records subject to Privacy Act requirements until 
an independent panel of experts finds that adequate information security has been established and 
implemented by VA, unless such activity is explicitly allowed by Court order and under 
supervision of persons independent of VA, such supervision to be at VA expense; 

e. That this Court enjoin Defendant VA, its officers, agents, employees, and 
those acting for and with them fi-om removing any device capable of storing, containing, or 
transferring any record or system of records, including, but not limited to, laptop computers, 
portable hard drives, memory stick or similar devices, and "iPods" and similar devices, firom 
property under VA's supervision and control until and unless VA demonstrates that adequate 
information security has been established to the Court's satisfaction. 

£ That this Court grant to Plaintiffs and the Class judgment against 
Defendant VA for damages in an amount of $1,000.00 for each individual who was adversely 
affected by Defendant's Privacy Act violations; 
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fees; and 



g. That this Court grant to Plaintiffs their costs and reasonable attorneys' 



h. That this Court grant such additional reUef as the Court deems proper and 



Dated: June 21, 2006 




Joseph H.J^eissCJW-^ 
Mark D. Smilow (MS-2809) 
Richard A. Acocelli (RA-2029) 
Weiss & Lurie 
551 Fifth Avenue 
New York, NY 10176 
Tel: (212) 682-3025 
Fax: (212) 682-3010 



Ca^3^§&-mQSGmmmif^M/^o(Sicimm6m3-2F\\eE\\^XFmm200ePa^^(aiS>6^50 



UJ ~5 



Cxj ;_»-, 






«l 



Eh M 
EhQ 



e P5 
; pa w 
; EH E-i 



CO P 

o 



(C o 
•H r- 
O « 

-H 

•H (d 
to nJ 

•H *t-l - 



IS n o 
O 0) o 
W-P . 

o> g 



> 0) IS 
« W 13 



^^ 






1 S.8 -g _f 



f s 



^1 



Ca^3^m--mQ3Gmmmif^M/^o(Sicimm6m3-2F\\eE\l^W/2m200QPa^^(ai^>6^50 
Case 2:06-cv-001 14-WOB Document 3 Filed 06/07/2006 Page 1 of 15 

Eastern District of 
FILED 



IN THE UNITED STATES DISTRICT COURT 
FOR THE EASTERN DISTRICT OF KENTUCKY 



JUN-7 2006 

AT COVINGTON 

LESLIE G WHITMER 

CLERK U S DISTRICT COURT 



PAUL HACKETT, 

1014 Vine Street, Suite 1690 

Cincinnati, OH 45202 

MATTHEW W. PAGE 
473 Beaver Road 
Walton, KY 41094 

Plaintiffs, 



UNITED STATES DEPARTMENT 
OF VETERANS AFFAIRS, 
810 Vermont Avenue NW 
Washington, DC 20420, 

R. JAMES NICHOLSON, Secretary 

of the United States Department of; 

Veterans Affairs, officially and 

individually, 

810 Vermont Avenue NW 

Washington, DC 20420, 

GORDON G. MANSFIELD, Deputy 
Secretary of the United States 
Department of Veterans Affairs, 
officially and individually, 
810 Vermont Avenue NW 
Washington, DC 20420, 

and 

JOHN DOE, employee of the 

United States Department of 

Veterans Affairs, officially and 

individually, 

c/o 810 Vermont Avenue NW 

Washington, DC 20420. 

Defendants. 
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I. PRELIMINARY STATEMENT 

1. Plaintiffs Paul Hackett and Matthew Page bring this action pursuant to the 
Privacy Act of 1974 and the Fourth and Fifth Amendments to the United States 
Constitution under the authority of Bivens v. Six: Unknown Named Agents of the 
Federal Bureau of Narcotics, 403 U.S. 388 (1971) on behalf of themselves and all others 
similarly situated against the United States Department of Veterans Affairs ("VA"), 
Secretary R. James Nicholson, Deputy Secretary Gordon H. Mansfield, and its 
employee, John Doe.i 

2. Plaintiffs, veterans of the United States Marine Corps and United States 
Navy, respectively, are two of more than 28.5 million military veterans and active duty 
personnel whose private personal information, including Social Security numbers, were 
improperly, unlawfully, willfully and intentionally disclosed in at least three ways: (1) 
through the access and removal of data files containing the private personal information 
of more than 28.5 million veterans and active duty members from the VA facility by 
employee John Doe; (2) through the transfer of the data to external and unprotected 
disks and/or computers by John Doe; and (3) through the alleged theft of these disks 
and/ or computers by a third party, the identity of whom may never be known. These 
disclosures, made without Plaintiffs' knowledge or consent, violate 5 U.S.C. § 552a(b). 

3. These disclosures were the direct and proximate resiilt of Defendants' 
willful and intentional failure to establish and enforce appropriate safeguards to ensure 
the security and privacy of veteran and active duty personnel records and to protect 
against any known or anticipated threats or hazards to the security and integrity of these 



' Plaintiffs may also file an administrative charge alleging invasion of privacy pursuant to the Federal Tort 
Claims Act as required under 28 U.S.C. § i346Cb). 
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records in violation of 5 U.S.C. § 552a(e)(io). 

4. Subsequent to learning of these disclosures, Defendants were deliberately 
indifferent in failing to take reasonable corrective action, including but not limited to, 
providing prompt and accurate notification of the disclosures to law enforcement and 
the affected veterans despite knowledge of the substantial risk of serious harm to the 
personal and financial security of the affected veterans as result of the disclosures, 

5. Defendants' disclosures of Plaintiffs' confidential Social Security numbers 
also violated Plaintiffs' right to privacy and personal security of their Social Security 
numbers under the Fourth and Fifth Amendments of the United States Constitution. 

6. As result of the Defendants' acts and omissions in disclosing and failing to 
protect Plaintiffs' private personal information, including their Social Security numbers. 
Plaintiffs and those similarly situated have been placed at a substantial risk of harm in 
the form of identity theft and have incurred and will incur actual damages in an attempt 
to prevent identity theft by purchasing services to monitor their credit information. The 
remedies sought include declaratory and remedial injunctive relief, damages and 
reasonable attorneys' fees and costs. 

II. JURISDICTION AND VENUE 

7. The jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1331. 
Federal jurisdiction is appropriate in this instance to secure protection and to redress 
deprivations of rights guaranteed under 5 U.S.C, § 552a and Bivens. 

8. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C. § 
1391(e). 
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III. PARTIES 

9. Plaintiff Paul Hackett is a veteran of the United States Marine Corps 
released from active duty in 1992 and honorably discharged from service in 1999. He is 
a resident of Hamilton County, Ohio. 

10. Plaintiff Matthew Page is a veteran of the United States Navy retired from 
active duty and honorably discharged from service in 2001. He is a resident of Boone 
County, KentuclQ^. 

11. Defendant VA is a cabinet of the Executive Branch of the United States 
Government which, in the course of its duties, compiles and maintains records of all 
individuals discharged from a branch of the United States military and provides benefits 
and services to veterans, including among other things, pension payments and health 
care. Upon information and belief, Defendant VA also compiles and maintains records 
of some or all active duty members of the United States military. 

12. Defendant R. James Nicholson is the duly-confirmed Secretary of United 
States Department of Veterans Affairs and is responsible for the enactment and 
enforcement of all VA policies and procedures, including those pertaining to safeguards 
to ensure the security and privacy of veteran and active duty records and to protect 
against any anticipated threats or hazards to the security and integrity of these records. 
He is sued in his official and individual capacities. 

13. Defendant Gordon H. Mansfield is the duly-appointed Deputy Secretary of 
the United States Department of Veterans Affairs and is responsible for the enactment 
and enforcement of all VA policies and procedures, including those pertaining to 
safeguards to ensure the security and privacy of veteran and active duty records and to 

4 
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protect against any anticipated threats or hazards to the security and integrity of these 
records. He is sued in his official and individual capacities. 

14. Defendant John Doe is a long-time employee of the VA who was assigned 
as a data analyst. Upon information and belief, John Doe engaged in conduct 
tantamount to a willful and intentional disclosure of and failure to protect the private 
personal information of Mr. Hackett, Mr. Page and the approximately 28.5 million other 
veterans and active duty personnel. He is sued in his official and individual capacities. 

IV. STATEMENT OF FACTS 

15. In connection with their honorable discharges afi:er service with the 
United States Marine Corps and United States Navy, Plaintiffs were required to provide 
the VA with their private personal information, including Social Security numbers. 

16. On or about May 22, 2006, Secretary Nicholson pubKcly announced 
through worldwide media outlets that the private personal information of approximately 
26.5 million veterans discharged after 1975 had been disclosed. Secretary Nicholson 
identified the private personal information of these veterans disclosed as their names, 
dates of birth, Social Security numbers, and, in some instances disability ratings and 
certain medical information. Nearly two weeks later, on or about June 6, 2006, 
Secretary Nicholson pubHcly announced that the files also contained these individuals' 
addresses and telephone numbers. 

17. On or about June 6, 2006, Secretary Nicholson publicly announced that 
the disclosure affected a much broader scope of individuals that initially reported on 
May 22, 2006, involving information of both veterans and active duty personnel. 
Specifically identified were 1.1 million active duty personnel, 430,000 members of the 
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National Guard, and 645,000 members of the Reserves. The private personal 
information of these individuals disclosed included names, addresses, telephone 
numbers, dates of birth, Social Security numbers, disability ratings, and upon 
information and belief, certain medical information. 

18. Secretary Nicholson reported the disclosure was connected to an alleged 
burglary of the home of Defendant John Doe. Upon information and belief, on or about 
May 3, 2006, John Doe, a data analyst and long-time VA employee, had removed VA 
files containing private personal information of more than 28.5 million veterans and 
active duty personnel from the VA facility and taken it to his home. John Doe then 
copied the files onto his computer and/or external disks for an unspecified purpose. 
John Doe's computer and/or disks were allegedly stolen during a burglary of his home. 
Upon information and belief, these items have not been recovered as of the date of the 
filing of this Complaint. They are not believed to be encrypted or password protected 
and can be easily accessed and duplicated. 

19. Upon information and belief, John Doe was able to easily access computer 
files containing private personal information of 28.5 million veterans and active 
personnel copy the files fi:om the VA's system onto external disks and his personal 
computer. Upon further information and belief, John Doe had been removing the data 
from the VA facility for a period of three years in a practice expressly or implicitly 
ratified by the VA. John Doe's access to and duphcation of this information was a 
disclosure in violation of 5 U.S.C. § 552a(b) and the result of Defendants' willful and 
intentional failure to establish appropriate safeguards to ensure the security and 
confidentiality of veteran and active duty personnel records and to protect against any 

6 



Ca^Skm--mQ3Gmmmf3M/^o6Diamm6p&3-2F\\emM!im//2m200ePa^s^^SZQi50 
Case2:06-cv-00114-WOB Documents Filed 06/07/2006 Page 7 of 15 



anticipated threats or hazards to the security and integrity of these records in violation 
of 5 U.S.C. § 552a(e)(l0). 

20. Upon information and belief, upon learning of the above-described 
disclosures, Secretary Nicholson and Deputy Secretary Mansfield unreasonably delayed 
reporting the disclosures to law enforcement agencies despite knowledge of the 
imminent and substantial risk of serious harm to the personal security of the affected 
veterans and active duty personnel. VA Inspector General George Opfer publicly stated 
that he was never formally notified of the disclosures, but rather heard about it through 
"gossip." 

21. Three weeks after the alleged burglary, on or about May 22, 3006, 
Secretary Nicholson advised media outlets that the 26.5 million veterans whose private 
persona] information was disclosed were subject to a heightened risk for identity theft. 
He urged the veterans to be "extra vigilant and to carefully monitor bank statements, 
credit card statements and any statements relating to recent financial transactions." 
Nearly two weeks later, on or about June 6, 2006, Secretary Nicholson advised media 
outlets that the disclosures involved nearly 2.2 million active duty members of the 
military as well. Upon information and belief, Defendants have not yet individiially 
notified the affected veterans. 

22. Defendants knew or should have known that their computer security 
practices were not in compliance with 5 U.S.C. § 552a as well as other federal laws 
relating to information security. In 2003, a study conducted by the General Accounting 
Office (GAO) gave the VA a failing grade for its computer security practices. In March 
2006, the United States House of Representative's Committee on Government Reform 
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gave the VA an "F" in its annual report card relating to information security. Despite 
this ample and specific notice of noncompliance and the potential adverse effect of 
random and unauthorized disclosures of personal information, Defendants failed to 
establish appropriate safeguards to ensure the security and confidentiality of veteran 
and active duty personnel records and to protect against any anticipated threats or 
hazards to the security and integrity of these records in violation of 5 U.S.C. § 
552a(e)(io). 

23. The unauthorized and unconsented disclosure of an individual's name, 
address, telephone number, date of birth and Social Security number creates a 
substantial risk of identity theft. An individual's Social Security number is the most 
useful identifier for retrieving information from public record databases, financial 
institutions and credit bureaus. Armed with an individual's name, address, date of birth 
and Social Security number, an identity thief is able to quickly and easily steal an 
identity, whereas, without such information, the task is difficult, time consuming and 
costly. 

24. Recent nationwide studies confirm that, on average, victims of identity 
theft spend hundreds of hours in personal time and hundreds of dollars in personal 
funds to resolve their credit issues. See www.idtheftcenter.org ; www.ftc.org . 

25. Defendants' unauthorized and unconsented disclosures of Plaintiffs 
private personal information and the imminent and substantial risk of identity theft to 
which Plaintiffs has been exposed is the direct result of Defendants' failm-e to: (1) 
establish appropriate administrative, technical and physical safeguards to ensure the 
security and confidentiality of records; (2) to protect against any anticipated threats or 
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hazards to the security and integrity of these records; and (3) to promptly take 
reasonable measures to correct the disclosures, including but not limited to, providing 
law enforcement and the affected veterans and active duty personnel with prompt and 
accurate notice of the disclosures. 

26. As a direct and proximate result of Defendants' acts and omissions, 
Plaintiffs have been exposed to a risk of substantial harm and inconvenience, and have 
incurred actual damages in purchasing comprehensive credit reports and/ or monitoring 
of their identity and credit. 

V. CLASS ALLEGATIONS 

27. Plaintiffs maintain this action on behalf of themselves and all individuals 
whose private personal information, including Social Security numbers, were disclosed 
by Defendants in May 2006 as described above. 

28. The members of the putative class are so numerous that joinder of 
individual claims is impracticable. Moreover, there are significant questions of fact and 
issues of law common to the members of the putative class. These issues include 
whether Defendants failed to establish appropriate administrative, technical and 
physical safeguards to ensure the security and confidentiality of records and to protect 
against known and anticipated threats or hazards to the security and integrity of these 
records, whether such failure was willful and intentional, whether the putative class 
members were adversely affected, and whether they incurred actual damages as result. 

29. Plaintiffs' claims are typical of the claims of the putative class. Plaintiffs 
and all members of tibie putative class have been adversely affected and damaged in that 
their private information has been compromised and stolen. 
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30. The proposed class representatives will fairly and adequately represent the 
putative class because they have the class members' interest in mind, their individual 
claims are co-e5ctensive with and identical to those of the class, and because they are 
represented by qualified counsel experienced in class action litigation of this nature. 

31. A class action in this instance is superior to other available methods for the 
fair and efficient adjudication of these claims since individual joinder of the claims of all 
members of the putative class is impracticable. Most members of the class are without 
the financial resources necessary to pursue this matter. Even if some members of the 
class could afford to litigate their claims separately, such a result would be unduly 
burdensome to the courts in which the individualized cases would proceed. Individual 
litigation increases the time and expense of resolving a common dispute concerning 
Defendants' actions toward an entire group of individuals. Class action procedures 
allow for far fewer management difficulties in matters of this type and provide the 
unique benefits of unitary adjudication, economy of scale and comprehensive 
supervision over the entire controversy by a single court. 

32. The putative class may be certified pursuant to Rule 23(b)(1) of the 
Federal Rules of Civil Procedure because inconsistent or varying adjudications with 
respect to individual class members would establish incompatible standards of conduct 
for Defendants to follow. 

33. The putative class may be certified pursuant to Rule 23(b)(2) of the 
Federal Rules of Civil Procedure because Defendants have acted on grounds generally 
applicable to the putative class thereby making final injunctive relief and corresponding 
declaratory relief appropriate with respect to the claims raised by the class. 
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34. The putative class may be certified pursuant to Rule 23Cb)(3) of the 
Federal Rules of Civil Procedure because questions of law and fact common to class 
members will predominate over questions affecting individual members and a class 
action is superior to other methods for fairly and efficiently adjudicating the controversy 
and causes of actions described in the Complaint. 

VI. STATEMENT OF CLAIMS 
COUNT ONE 
35- Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs i through 34 herein above. 

36. The foregoing acts and omissions of Defendant VA constitute an 
unauthorized, nonconsensual, and inappropriate disclosure of Plaintiffs' Social Security 
numbers in violation of 5 U.S.C. § 552a(]b). 

COUNT TWO 

37. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 36 herein above. 

38. The foregoing acts and omissions of Defendant VA constitutes a willful 
and intentional failure to establish appropriate safeguards to ensure the security and 
privacy of veteran and active duty personnel records and to protect against known and 
anticipated threats or hazards to the security and integrity of Plaintiffs private personal 
records in violation of 5 U.S.C. § 552a(e)(io). 

COUNT THREE 

39. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 38 herein above. 
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40. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe constitute a violation of Plaintiffs' right to privacy in their Social Security 
numbers under the Fourth and Fifth Amendments to the United States Constitution. 

COUNT FOUR 

41. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 40 herein above. 

42. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe constitute a violation of Plaintiffs' right to personal security under the Fourth 
and Fifth Amendments to the United States Constitution. 

COUNT FIVE 

43. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 42 herein above. 

44. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe deprived Plaintiffs of their right to procedural and substantive due process 
under the Fifth Amendment to the United States Constitution. 

COUNT SIX 

45. Plaintiffs repeat and reaffirm the assertions of fact contained in 
paragraphs 1 through 44 herein above. 

46. The foregoing acts and omissions of Defendants Nicholson, Mansfield and 
John Doe were done in deliberate indifference to rights guaranteed to Plaintiffs under 
the Fourth and Fifth Amendments to the United States Constitution. 
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VII. PRAYER FOR RELIEF 
WHEREFORE, Plaintiffs, on behalf of themselves and all others similarly 
situated, hereby demand judgment against Defendants as follows: 

a. For a declaration that Defendants' acts and omissions constitute a willful 
and intentional failure to establish appropriate safeguards to ensure the security and 
privacy of veteran and active duty personnel records and to protect against known and 
anticipated threats or hazards to the security and integrity of these records in violation 
of 5 U.S.C. § 552a(e)(io) and the Fourth and Fifdi Amendments of the United States 
Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting 
and preventing Defendants from continuing to operate without appropriate safeguards 
to ensure the security and privacy of veteran and active duty personnel records and to 
protect against anticipated threats or hazards to the security and integrity of these 
records. 

c. For reparative injunctive relief under Bivens requiring Defendants to take 
necessary measures to safeguard against the serious harm attendant to the improper 
disclosure/theft of confidential information including an identity and/or credit 
monitoring program and a preemptive internet search service for the benefit of Plaintiffs 
and the proposed class imder the Court's supervision; 

d. For an award of damages for Plaintiffs and each affected class member in 
an amount no less than $1,000.00; 
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e. For an award of reasonable attorney fees and costs incurred by Plaintiffs 
and the members of the putative class in prosecuting this matter; and 

f . For an award of such other relief in law and equity to which Plaintiffs and 
the members of the putative class may be entitled under the premises. 

Respectfully subp; 
MEZIBOV/^ 




MAftet). MEZIBOV (Ohio Bar No. 0019316;) 
401 East Court Street, Suite 600 
Cincinnati, Ohio 45202 
Telephone: (513) 723-1600 
Telecopier: (513) 723-1620 
mmezibov(5>mezibovienkins.com 

Attorney for Plaintiffs 

Of Counsel: 

MEZIBOV & JENKINS, CO. L.P.A 

CHRISTIAN A. JENKINS (Ohio Bar No. 0070674) 
STACY A. HINNERS (Ohio Bar No. 0076458) 
401 East Court Street, Suite 600 
Cincinnati, Ohio 45202 
Telephone: (513) 723-1600 
Telecopier: (513) 723-1620 
cjenldns(fl)mezibovienkins.com 
shinnerscgimezibovienkins.com 

MURDOCK, GOLDENBERG, SCHNEIDER & 
GROH LPA 

JOHN C. MURDOCK (Ohio Bar No. 0063749) 
JEFFERY S. GOLDENBERG (Ohio Bar No. 0063771) 
35 East Seventh Street, Suite 600 
Cincinnati, OH 45202 
Telephone: (513) 345-8291 
Telecopier: (513) 345-8294 
jmurdock@mgsglaw.com 
jgoldenberg@mgsglaw.com 
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CERTIFICATE OF SERVICE 

A true and accurate copy of the foregoing was filed with the Clerk and served to 
the following via regular U.S. mail on this 7* day of June 2006: John C. Murdock and 
Jeffeiy S. Goldenberg, 35 E. Seventh Street, Suite 600, Cincinnati, OH 45202; Alberto 
Gonzalez, United States Attorney General, Department of Justice, 950 Pennsylvania 
Avenue NW, Washington, DC 20530-0001; Amul R. Thapar, United States Attorney for 
the Eastern District of Kentucky, 110 West Vine Street, Suite 400, Lexington, KY 
40507-1671; United States Department of Veterans Affairs, 810 Vermont Avenue NW, 
Washington, DC 20420; R. James Nicholson, Sio^ermont Memxe N\f^^36JasMiigrop, 
DC 2042o;GordonG.MansMd, 810 Vermont AbenueNW/Washing^, DC 2042,0'^ 



MARC D. MEZIBOV (Ohio Bar No. 0019316) 
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U.S. Department of Justice 

Civil Division 

Federal Programs Branch 

P.O. Box 883 

Ben Franklin Station 

Washington, D.C. 20044 




Senior Trial Counsel 



Tel: (202) 514-2395 
Fax:(202)616-8202 



August 21, 2006 



FILED ELECTRONICALLY 

Honorable Eric. N. Vitaliano 
United States District Judge 
Eastern District of New York 
225 Cadman Plaza East 
Brooklyn, New York 11201 

RE: Rosato, et ai, v. Nicholson, et ai. No. CV-06-03086 (ENV)(JMA) 

Dear Judge Vitaliano: 

Defendants respectfully submit this letter to request a pre-motion conference in the 
above-referenced matter. Defendants intend to move this Court pursuant to 28 U.S.C. § 1404 to 
transfer this case to the District Court for the District of Columbia. In the alternative. 
Defendants will request a stay of proceedings pending a ruling on Defendants' Motion for 
Transfer and Coordination pursuant to 28 U.S.C. § 1407, filed on July 10, 2006, with the Judicial 
Panel on Multidistrict Litigation. The motion will be made on the following grounds, among 
others: 

As has been widely reported in the press, a laptop and external hard drive containing 
personal information for approximately 26 million veterans and active duty personnel were 
stolen from the home of a VA employee on May 3, 2006. On June 29, 2006, authorities 
announced the recovery of the stolen equipment, and the FBI has concluded with a high degree 
of confidence that the VA data was not accessed or compromised. This case is one of at least 
three putative nationwide class action lawsuits that have been filed bringing Privacy Act and 
other claims against the VA based on the theft of the computer equipment. The other two cases 
have been filed in the District for the District of Columbia, and in the Eastern District of 
Kentucky. See Vietnam Veterans of America v. Nicholson (06-1038) (D.D.C.); Hackettv. United 
States Department of Veterans Affairs (06-1 14) (E.D. Ky.). Defendants have moved to transfer 
the Hackett case to the District for the District of Columbia, and that motion is pending. 

These cases raise similar claims on behalf of an identical putative class based on the 
same underlying events. In order to preserve judicial and party resources, to prevent duplicative 
and inconsistent orders and rulings, and to facilitate discovery, this case should be transferred to 
the District for the District of Columbia. If this Court elects not to transfer this case, then the 
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case should be stayed pending a ruling on Defendants' Motion for Transfer and Coordination 
pursuant to 28 U.S.C. § 1407, filed on July 10, 2006, with the Judicial Panel on Multidistrict 
Litigation. 

This Court possesses broad discretion to "transfer any civil action to any other district or 
division where it might have been brought" and it may do so "[f]or the convenience of parties 
and witnesses, in the interest of justice." 28 U.S.C. § 1404(a); see also Stewart Organization, 
Inc. V. Ricoh Corp., 487 U.S. 22, 27 (1988) (Section 1404(a) vests "discretion in the district 
court to adjudicate motions to transfer according to individualized, case-by-case consideration of 
convenience and fairness."). The purposes of 28 U.S.C. § 1404(a) are to "prevent the waste of 
time, energy, and money and to protect litigants, witnesses and the public against unnecessary 
inconvenience and expense." Van Dusen v. Barrack, 376 U.S. 612, 616 (1964) (citations 
omitted). Here, both public and private interests counsel strongly in favor of transferring this 
action to the District for the District of Columbia. 

The three pending cases filed in response to the theft are all based on the same incident, 
all allege a breach of the Privacy Act, and all seek to represent the same class. Thus, each case 
will require the same potential discovery into the same facts, with testimony from the same 
witnesses, and the same potential discovery disputes. Additionally, each case will raise identical 
legal issues including the propriety of class certification, the interpretation of the Privacy Act, 
and the scope of remedy, if any. Thus, consolidation of these cases in a single venue will result 
in enormous savings to the resources of parties, witnesses, and the courts. Additionally, 
consolidation will prevent inconsistent legal rulings and inconsistent case management orders, 
both of which could prejudice the parties and undermine the systemic integrity of the judiciary 

These substantial efficiencies and systemic integrity can only be realized fully if this case 
is transferred to the District of Columbia. This is because the other cases cannot be transferred 
to this District. In a Privacy Act case, venue is proper "in the district court of the United States 
in the district in which the complainant resides, or has his principal place of business, or in 
which the agency records are situated, or in the District of Columbia." 5 U.S.C. § 552a(g)(5). 
Thus, for any Privacy Act suit brought based on the theft, venue will be proper in the District of 
Columbia, as it is a proper venue for all Privacy Act cases, and it is the location of the VA's 
agency records. Venue will not be proper in another district unless a named plaintiff in that 
particular suit lives or works in that district. Thus, the case pending in Kentucky (whose named 
plaintiffs are all non-New York residents) could not be transferred here. See 28 U.S.C. § 1404(a) 
(transfer is only permitted to a district where the action could have originally been brought). 

In addition to the significant efficiency and the avoidance of duplicative and inconsistent 
rulings described above, additional factors support transfer of venue. Importantly, key witnesses 
and documentary evidence are in or near Washington, D.C., and the events that give rise to this 
litigation occurred in or near Washington, D.C. 

In the event that this Court elects not to transfer this case. Defendants' intend to seek a 
stay of proceedings pending a ruling on Defendants' Motion for Transfer and Coordination 
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pursuant to 28 U.S.C. § 1407, filed with the Judicial Panel on Multidistrict Litigation, seeking 
transfer of all cases to a single court for coordinated pre-trial proceedings. That motion is 
scheduled for argument on September 28, 2006. Entering a short stay until the Panel issues its 
order on transfer and consolidation would unquestionably serve the interests of judicial 
efficiency and economy. The Panel was "established by Congress specifically to ameliorate . . . 
duplicative litigation and . . . waste of judicial resources." Johnson v. AMR Corp., Nos. 95 C 
7659 et al, 1996 WL 164415, at *3 (N.D. 111. Apr. 3, 1996); see 28 U.S.C. §1407 (transfer and 
consolidation is warranted to "promote the just and efficient conduct" of actions raising common 
questions of fact). In the absence of a stay, these benefits of multidistrict litigation would be 
lost. See, e.g.. The Hertz Corp. v. The Gator Corp., 250 F. Supp. 2d 421, 428 (D.N.J. 2003). It 
would be a waste of judicial resources for this Court to "needlessly expend[] its energies 
familiarizing itself with the intricacies of a case that would be heard by another judge." Rivers v. 
Walt Disney Co., 980 F. Supp. 1358, 1360 (CD. Cal. 1997). 

Moreover, Defendants will be unduly and needlessly burdened if they are forced to file 
motions to dismiss, respond to any potential discovery, and reply to class certification and other 
motions separately in each of the three putative class actions now pending against them. See, 
e.g.,Aikins v. Microsoft Corp., 2000 WL 310391, at *1 (E.D. La.) ("[Defendant] would suffer a 
considerable hardship and inequity if forced to simultaneously litigate multiple suits in multiple 
courts."). On the other hand. Plaintiffs will not be prejudiced by a stay of this nascent lawsuit. 
Defendants have not yet answered or otherwise responded to the complaint in this case or any of 
the other complaints that have been filed against them. No discovery has begun and "[bjarring 
unusual circumstances, the MDL Panel will decide the motion in a relatively short period of 
time." Hertz, 250 F. Supp. 2d at 425; see also Portnoy v. Zenith Labs., 1987 WL 10236, at *1 
(D.D.C.) ("The Court also finds that the delay that will result from this stay will be minimal."). 

For the foregoing reasons. Defendants intend to move this Court to transfer this action 
pursuant to 28 U.S.C. § 1404, or in the alternative, to stay proceedings pending a ruling by the 
Judicial Panel on Multidistrict Litigation. 

Respectfully submitted, 

PETER D. KEISLER 

Assistant Attorney General 
ROSLYNN R. MAUSKOPF 
United States Attorney 
ELIZABETH J. SHAPIRO 
Assistant Branch Director 
/s/ 



ORI LEV 

Senior Trial Counsel 
DAVID M. GLASS 
Senior Trial Counsel 
HEATHER R. PHILLIPS 
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Trial Attorney 
Counsel for Defendants 
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ORIGINAL FILED BY ECF 



August 28, 2006 



The Fred French Building 
551 Fifth Avenue 
New Yorl<, New Yorl< 10176 
TEL (212)682-3025 
FAX (212) 682-3010 

New Yorl< Los Angeles 



Honorable Eric N. Vitaliano 
United States District Judge 
Eastern District of New York 
225 Cadman Plaza East 
Brooklyn, New York 1 1201 



Re: 



Rosato, et al, v. Nicholson, et al, CV 06-3086 (ENV) (JMA) 



Dear Judge Vitaliano: 

Pursuant to Your Honor's individual rules and Defendants' letter dated August 21, 2006, 
advising of their intention to move for transfer of the case to the District of Columbia or, in the 
alternative, for a stay of the proceedings until resolution of Defendants' motion for transfer and 
coordination made to the Judicial Panel on Multidistrict Litigation, Plaintiffs respectfully respond 
as follows: 

Plaintiffs' choice of forum is clearly not vexatious nor meant to harass the Defendants, 
and judicial economy and efficiency do not require the transfer of this action under 28 U.S.C. § 
1404(a). Although the statute permits courts to grant transfers "upon a lesser showing of 
inconvenience" than was required under the doctrine of forum non conveniens, the plaintiffs 
"choice of forum should only be disturbed" if the forum chosen is "completely and utterly 
outweighed by the severe inconvenience of the defendant." Distefano v. Carozzi North America, 
Inc., 2002 U.S. Dist. LEXIS 23042 at *3, CV 98-7137(SJ) (E.D.N.Y. November 16, 2002) 
(citing Norwood V. Kirkpatrick, 349 U.S. 29, 32, (1955), and Laumann Mfg. Corp. v. Castings 
USA, Inc., 913 F. Supp. 712, 721 (E.D.N.Y. 1996)). Simply put, courts in the Second Circuit 
"are loath to disturb a plaintiffs choice of venue absent a showing that the balance of 
convenience and justice weighs heavily in favor of transfer." Distefano, 2002 U.S. Dist. LEXIS 
23042 at *3. The relevant criteria here, see Schwartz v. Marriott Hotel Servs., Inc., 1 86 F. Supp. 
2d 245, 248 (E.D.N.Y. 1994), dictate that transfer would be inappropriate. 



First, the convenience of the witnesses - a primary factor to be considered in this inquiry 
- favors retention of this case in New York. Defendants' only arguments on this score are that 
unidentified "key witnesses and documentary evidence are in or near Washington, D.C." 
However, that is insufficient to tip the balance in favor of transfer since the witnesses that 
Defendants would seek to call are or were presumably all employed by the Department of 
Veterans Affairs and, therefore, can be compelled to testify in this Court by virtue of the 
employment relationship with Defendants. Distefano, 2002 U.S. Dist. LEXIS 23042 at *8 ("The 
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Honorable Eric N. Vitaliano 
United States District Judge 
August 28, 2006 
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employees of the parties will as a practical matter be available in any venue by virtue of the 
employment relationship.") {citing Merkur v. Wyndham Int'l Inc., 2001 WL 477268 at *4, CV 
00-5843 (E.D.N.Y. March 30, 2001)). Similarly, Defendants' reliance upon the location of 
critical documents or other evidence is also deprived of both legal and practical weight by virtue 
of the modem photocopying and document handling technologies that would be employed in this 
case, just as they are employed in virtually every other case filed in the courts of this country. 
Distefano, 2002 U.S. Dist. LEXIS 23042 at *1 1-*12. 

Second, the convenience of the parties factor also favors retention of this case in New 
York. Although Defendants claim that they would suffer an unquantified and unqualified 
hardship if forced to litigate in New York, they ignore the fact that the hardship upon Plaintiffs 
would be real, not merely conceptual, and significantly worse. The Defendants are governmental 
entities of unlimited resources capable of defending their interests anywhere. Plaintiffs, on the 
other hand, are individuals of limited resources that have combined whatever resources are at 
their disposal to pursue their claims in this jurisdiction, which presents them with the least 
hardship. Thus, this factor also militates against transfer. 

Third, the locus of operative facts inquiry, part of which Defendants may correctly claim 
is in Washington, D.C., also encompasses New York - where Plaintiff Rosato was actually 
injured. See Distefano, 2002 U.S. Dist. LEXIS 23042 at *1 1 (relying upon the Second Circuit's 
prior finding in that case that the "situs of injury" is where the plaintiff was injured). Thus, 
Defendants cannot clearly establish that the locus of operative facts is solely in Washington, 
further militating against transfer of the action. 

Finally, Defendants' alternative request that the case be stayed pending resolution of their 
motion to the Judicial Panel on Multidistrict Litigation also lacks merit. The goals of judicial 
efficiency and economy are served - not hindered - by the resolution of claims in a reasonably 
expeditious manner. In fact, that is precisely why J.P.M.L. R. 1.5 provides that the pendency of a 
motion before the panel "does not affect or suspend orders and pretrial proceedings in the district 
court in which the action is pending and does not in any way limit the pretrial jurisdiction of that 
court." See United States ex rel. Cosens v. St. Francis Hosp., 241 F. Supp. 2d 223, 225 
(E.D.N.Y. 2002); Albert Fadem Trust v. WorldCom, Inc., 2002 U.S. Dist. LEXIS 12572 at *7, 
CV 02-3288 (S.D.N.Y. July 12, 2002). The indefinite stay that Defendants now seek, does not 
satisfy the efficiency and economic expectations of quick resolution. Moreover, Defendants fail 
to even address why the Panel's own rules against staying litigation in matters that are before it 
should not be adhered to. The claimed general systemic deficiencies of inconsistent resolutions 
or the multiplicity of proceedings are no more or less likely to occur prior to the resolution of the 
motion pending before the Panel as they are likely to occur afi;er the Panel rules. Finally, a stay is 
improper because it would visit prejudice upon Plaintiffs since the recollections of potential 
witnesses will fade and the ability to retrieve essential evidence can be lost through the passage 
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of idle time. In sum, a stay would unjustifiably prolong this litigation and increase both its cost 
and the burden on the Court 

For the foregoing reasons, among others. Plaintiffs intend to vigorously oppose 
Defendants' intended motion to transfer or stay this case, should such a motion be made. 




Ori Lev, Esq. (via email) 
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U.S. Department of Justice 

Civil Division 

Federal Programs Branch 

P.O. Box 883 

Ben Franklin Station 

Washington, D.C. 20044 




Ori Lev 

Senior Trial Coi 



Tel: (202)514-2395 
Fax: (202)318-7589 



September 18, 2006 

VIA FACSIMILE 
Honorable Eric N. Vitaliano 
United States District Judge 
Eastern District of New York 
225 Cadman Plaza East 
Brooklyn, New York 11201 

RE: Rosato. etal. v. Nicholson, etai. No. CV-06-03086 (ENV)(JMA) 

Dear Judge Vitaliano: 



On August 21, 2006, Defendants informed the Court that Defendants intend to move to 
transfer the above-referenced case pursuant to 28 U.S.C. § 1404, or, in the alternative, to stay all 
proceedings in this case pending a ruling by the Judicial Panel on Multidistrict Litigation 
("JPML") on Defendants' Motion for Transfer and Coordination of this and other cases pursuant 
to 28 U.S.C. § 1407, which was filed before the JPML on July 10, 2006. Your Honor has 
scheduled a pre-motion conference in this case for Thursday, September 28. For the reasons 
stated below, and with the consent of Plaintiffs' counsel, I request (i) advancement of the pre- 
motion conference and (ii) that Your Honor "So Order" the attached Stipulation extending 
Defendants' time to respond to the Complaint. 

The JPML has scheduled a hearing with oral argument on the motion previously made to 
that panel for the morning of Thursday, September 28 in Santa Ana, California. In addition to 
this scheduling conflict, the transfer motion Defendants intend to file in this case is directly 
related to the motion pending before the JPML. Accordingly, if Your Honor's schedule permits, 
I respectfully request that the pre-motion hearing in this case be rescheduled to a date and time 
prior to the JPML hearing scheduled for September 28. As noted above. Plaintiffs' counsel does 
not oppose this request, and we have jointly identified the following dates and times when both 
Plaintiffs' counsel and I (or a colleague) are available to appear for a pre-motion conference in 
this case: Wednesday, September 20; Friday, September 22; or the morning of Tuesday, 
September 26. In the event that the Court is unable to accommodate these alternate dates, both 
Plaintiffs' counsel and I are prepared to appear on September 28 (Le^, we are not asking to 
adjourn the hearing to a later date). 
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September 18, 2006 
Page 2 



Finally, I respectfully request that the Court "So Order" the attached, executed stipulation 
extending the response date for Defendants until after resolution of the transfer/stay issue in this 
Court. 

Thank you in advance for your attention to this matter. 

Respectflilly submitted. 



Mark D. Smilow 



Ori Lev 

Counsel for Defendants 
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UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 



MICHAEL ROSATO, et al . 

Plaintiffs, 



R. JAMES NICHOLSON, in his official 
capacity as Secretary of Veterans Affairs, et al. , 



No. l:06-cv-3086-ENV-JMA 



STIPULATION AND [PROPOSED] ORDER EXTENDING DEFENDANTS' 
TIME TO ANSWER OR OTHERWISE RESPOND TO THE COMPLAINT 

WHEREAS a pre-motion letter and response thereto have been filed in connection with 
Defendants' intent to file a motion to transfer this case pursuant to 28 U.S.C. § 1404, or, 
alternatively, to stay all proceedings pending a ruling by the Judicial Panel on Multidistrict 
Litigation ("JPML") on Defendants' Motion for Transfer and Coordination pursuant to 28 U.S.C. 
§ 1407 filed before the JPML on July 10, 2006; 

WHEREAS the Court scheduled a pre-motion conference for September 28, 2006; 

WHEREAS Defendants' response to the Complaint is currently due September 19, 2006; 
and 

WHEREAS Defendants have not previously sought an extension of time to respond to the 
Complaint; 

The parties hereby stipulate and agree as follows: 

1 . Defendants' time to respond to the Complaint shall be stayed pending the Court's 

ruling upon or other disposition of the transfer/stay motion that Defendants intend to file in this 
Court, and Defendants' response to the Complaint shall be due ten days after such ruling or 
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disposition in the event that the case is not transferred or stayed. 



Dated: September 18, 2006 



/s/ Mark Smilow (by permission) 

Mark D. Smilow (MS 2809) 

WEISS & LURIE 

551 Fifth Avenue 

Suite 1600 

New York, NY 10176 

(212) 682-3025 

Fax: (212) 682-3010 

Attorneys for Plaintiffs 



PETER D. KEISLER 
Assistant Attorney General 

ROSLYNN R. MAUSKOPF 

United States Attorney 

ELIZABETH J. SHAPIRO 
Assistant Branch Director 



/s/ Ori Lev 

ORILEV 

DAVID M. GLASS 

HEATHER R. PHILLIPS 

Attorneys 

U.S. Department of Justice 

Civil Division/Federal Programs Branch 

P.O. Box 883 

Washington, D.C. 20044 

(202)514-2395 

Fax:(202)318-7589 

Attorneys for Defendants 



SO ORDERED. 

Dated: 



ERIC N. VITALIANO 
United States District Judge 
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UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 



MICHAEL ROSATO, et al. . 

Plaintiffs, 



R. JAMES NICHOLSON, in his official 
capacity as Secretary of Veterans Affairs, et al. . 



No. l:06-cv-3086-ENV-*MA ppj 

IN CLERK'S OFFICE 
U.S. DISTRICT COURT ED.N.Y 

* .-2 2 * 



STIPULATION AND [PROPOSED] OR]>ER EXTENDING DEFENDANTS' 
TIME TO ANSWER OR OTHERWISE RESPOND TO THE COMPLAINT 

WHEREAS a pre-motion letter and response thereto have been filed in connection with 
Defendants' intent to file a motion to transfer this case pursuant to 28 U.S.C. § 1404, or, 
alternatively, to stay all proceedings pending a ruling by the Judicial Panel on Multidistrict 
Litigation ("JPML") on Defendants' Motion for Transfer and Coordination pursuant to 28 U.S.C. 
§ 1407 filed before the JPML on July 10, 2006; 

WHEREAS the Court scheduled a pre-raotion conference for Seirtember 28, 2006; 

WHEREAS Defendants' response to the Complaint is currently due September 19, 2006; 
and 

WHEREAS Defendants have not previously sought an extension of time to respond to the 
Complaint; 

The parties hereby stipulate and agree as follows: 

1 . Defendants' time to respond to the Complaint shall be sta> ed pending the Court' s 
ruling upon or other disposition of the transfer/stay motion that Defendants intend to file in this 
Court, and Defendants' response to the Complaint shall be due ten days after such ruling or 
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disposition in the event that the case is not transferred or stayed. 
Dated: September 18, 2006 



/s/ Mark Smilow (by permission) 

Mark D. Smilow (MS 2809) 

WEISS & LURIE 

551 Fifth Avenue 

Suite 1600 

New York, NY 10176 

(212)682-3025 

Fax:(212)682-3010 

Attorneys for Plaintiffs 



SO ORDERED. 



PETER D. KEISLEfL 
Assistant Attorney (jeiaeral 



ROSLYNN R. MAtSKOPF 

United States Attoni'jj' 



ELIZABETH J. SH/J' IRO 

Assistant Branch Direcjtor 



/s/ Ori Lev 

ORI LEV 

DAVID M. GLASS 

HEATHER R. PHILLIPS 

Attorneys 

U.S. Department of Justice 

Civil Division/Fedenl Programs Branch 

P.O. Box 883 

Washington, D.C. 20044 

(202)514-2395 

Fax:(202)318-7589 

Attorneys for Defenaants 

/n / 



ERIC N. VITALIANC' 
United States District .Fudge 
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UNITED STATES DISTRICT COURT 
FOR THE EASTERN DISTRICT OF NEW YORK 



ROSATO, et al., 



NICHOLSON, et al., 



Defendants. 



Civil Action No. 06-3086 (ENV) 



NOTICE OF ATTORNEY APPEARANCE 

The Clerk of the Court will please enter the appearances of Heather Phillips, Trial 
Attorney for the Department of Justice, as counsel of record for the defendant in the above- 
captioned case. 



Respectfully submitted. 



_/s/_ 



Heather Phillips 

Trial Attorney 

Department of Justice 

Federal Programs Branch 

20 Massachusetts Ave, N.W., Room 7222 

(202) 616-0679 
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U.S. Department of Justice 

Civil Division 

Federal Programs Branch 

P.O. Box 883 

Ben Franklin Station 

Washington, D.C. 20044 




Senior Trial Counsel 



Tel: (202) 514-2395 
Fax:(202)616-8202 



October 13, 2006 

FILED ELECTRONICALLY 

Honorable Eric. N. Vitaliano 
United States District Judge 
Eastern District of New York 
225 Cadman Plaza East 
Brooklyn, New York 11201 

RE: Rosato, et ai, v. Nicholson, et ai. No. CV-06-03086 (ENV)(JMA) 

Dear Judge Vitaliano: 

As discussed at the September 26, 2006 pre-motion hearing, and as further noted in the 
Court's September 26, 2006 Minute Entry, the parties have agreed upon, and request approval 
of, the following briefing schedule for defendants' motion to transfer venue pursuant to 28 
U.S.C. § 1404: 

*Defendants will serve plaintiffs with defendants' motion to transfer on or before 
November 17, 2006. 

*Plaintiffs will serve defendants with plaintiffs' opposition to the motion to transfer on or 
before December 15, 2006. 



*Defendants will serve plaintiffs with defendants' reply on or before December 29, 2006, 
and that same date will, as required by the Court's individual motion practice and rules, 
file a full set of the motion papers with the Court. 
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Respectfully submitted, 

PETER D. KEISLER 

Assistant Attorney General 
ROSLYNN R. MAUSKOPF 
United States Attorney 
ELIZABETH J. SHAPIRO 
Assistant Branch Director 



_/s/_ 



_/s/_ 



MARK D. SMILOW 

Weiss & Lurie 

The French Building 

551 Fifth Avenue, Suite 1600 

New York, New York 10176 

Counsel for Plaintijfs 



ORI LEV 

Senior Trial Counsel 
DAVID M. GLASS 
Senior Trial Counsel 
HEATHER R. PHILLIPS 

Trial Attorney 
Counsel for Defendants 
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^^^^ U.S. Department of Justice 

^^^^^^^ Civil Division 

^--^^*- '^\ Federal Programs Branch 

''^■^*^ ' P.O. Box 883 

Ben Franklin Station 
Washington, D.C. 20044 



OriLev Tel: (202) 514-2395 

Senior Trial Counsel Fax: (202) 616-8202 

October 16, 2006 

FILED ELECTRONICALLY 
Magistrate Judge Joan M. Azrack 
Eastern District of New York 
225 Cadman Plaza East 
Brooklyn, New York 11201 

RE: Rosato, et ai, v. Nicholson, et ai. No. CV-06-03086 (ENV)(JMA) 

Dear Magistrate Judge Azrack: 

The above-captioned matter is a putative class action involving millions of potential 
plaintiffs alleging Privacy Act and other violations stemming from the theft of a laptop from the 
home of a Department of Veterans Affairs employee in April of 2006. Two additional - 
virtually identical - putative class actions have been brought by different named plaintiffs in the 
Eastern District of Kentucky and the District for the District of Columbia. 

On June 23, 2006, the Court issued an Order setting an initial conference in this matter 
for October 24, 2006. Subsequently, on July 10, 2006, defendants filed a motion pursuant to 28 
U.S.C. § 1407 with the Judicial Panel on Multidistrict Litigation ("JPML") requesting a transfer 
of this case (as well as the case filed in the Eastern District of Kentucky) to the District Court for 
the District of Columbia. A hearing on defendants' § 1407 transfer motion was held before the 
JPML on September 28, 2006. The JPML has not yet ruled on defendants' motion. In addition, 
in the event that the JPML does not grant defendants' § 1407 transfer motion, defendants 
requested leave of the Court to file a transfer motion pursuant to 28 U.S.C. § 1404. The Court 
granted defendants leave to file a § 1404 transfer motion, and on October 13, 2006, counsel for 
plaintiffs and defendants filed a joint briefing schedule with the Court, with briefing to be 
concluded by December 29, 2006. Finally, on September 18, 2006, plaintiffs and defendants 
entered into a Stipulation staying defendants' obligation to answer or otherwise respond to 
plaintiffs' complaint until ten days after the Court's ruling on defendants' § 1404 transfer 
motion. 

In light of the pending § 1407 transfer motion and the forthcoming § 1404 transfer 
motion, and given that defendants have not yet answered the complaint, and have no obligation 
to do so until the Court has ruled on defendants' proposed § 1404 transfer motion, defendants 
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request that the Court adjourn the initial conference set for October 24, 2006, until after 
defendants' transfer motions have been decided. Counsel for plaintiffs informed counsel for 
defendants that he opposes defendants' request for adjournment of the initial conference. 

Respectfully submitted, 

PETER D. KEISLER 

Assistant Attorney General 
ROSLYNN R. MAUSKOPF 
United States Attorney 
ELIZABETH J. SHAPIRO 
Assistant Branch Director 

/s/ 



ORI LEV 

Senior Trial Counsel 
DAVID M. GLASS 
Senior Trial Counsel 
HEATHER R. PHILLIPS 

Trial Attorney 
Counsel for Defendants 



CagasleOeQfiHfiSOSe^eNJ^JMfiocLDKreatTfertiS1 1 F\\§iimm/WQm6 Pagagleol at 2 

Weiss &LURIE 

The Fred French Building 
551 Fifth Avenue 
NewYorl<, New Yorl< 10176 
TEL (212)682-3025 
FAX (212) 682-3010 

New Yorl< Los Angeles 

October 17,2006 

FILED ELECTRONICALLY 

Magistrate Judge Joan M. Azrack 
Eastern District of New York 
225 Cadman Plaza East - Room 121 OS 
Brooklyn, New York 1 1201 

Re: Rosato. et al. v. Nicholson, etal.^o. CV-06-03086 (ENV)aMA) 

Dear Magistrate Judge Azrack: 

We represent the plaintiffs in the captioned matter and write to respond to the 
government's request for an indefinite extension of Your Honor's previously scheduled initial 
conference in this matter. We are generally not adverse to consenting to reasonable extensions or 
adjournments to accommodate any counsel's scheduling conflicts. However, we are opposed to 
such requests when they are calculated to impede the orderly prosecution of the case, indefinitely 
delay the discovery process, and prejudice our clients' rights. 

By way of background, after this matter was initially filed on June 21, 2006, we set out to 
serve each of the named defendants with process. Although we received return receipts from the 
Post Office for each of the defendants by no later than July 11, 2006, it took until August 14, 
2006, before the government acknowledged that it had misplaced the service copies and 
consented to the fact that it was validly served. Thereafter, the government has rebuffed our 
attempts to discuss a discovery plan so that we could get on with the prosecution of the matter. 

To be sure, the government has filed a motion with the Judicial Panel on Multidistrict 
Litigation ("JPML") seeking the transfer of the action and, separately, sought a conference with 
Judge Vitaliano to obtain leave to make a separate motion to transfer in this case. But the fact is 
that Rule 1 .5 of the JPML provides that the pendency of a motion before the Panel "does not 
affect or suspend orders and pretrial proceedings in the district court in which the action is 
pending and does not in any way limit the pretrial jurisdiction of that court (emphasis added). 
In addition, we believe that the motion to transfer that the government seeks to make in this case 
is of dubious merit, for the reasons set forth in our letter to Judge Vitaliano dated August 28, 
2006 - see Docket No. 5. 
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In sum, the government has sought to hide behind procedural motions and refuses to talk 
about the very discovery matters that could bring this case closer to resolution, whichever district 
it is eventually assigned to. We respectfully submit that the proper method to advance this 
litigation is to work out a schedule of discovery that accommodates all of the parties to the 
litigation. We believe that an initial conference will aid in this process and will not prejudice the 
defendants in any way. Accordingly, we respectfully request that the conference presently 
scheduled for October 24 not be adjourned. 



MDS/pjm 




Joseph H. Weiss, Esq. 
Ori Lev, Esq. (via email) 
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U.S. Department of Justice 

Civil Division 

Federal Programs Brancl' 

P.O. Box 883 

Ben Franklin Station 

Washington, D.C. 2004^. 



Ori Lev 

Senior Trial Counsel 



nCED 






A|Hplicii<li(a>n Granted 

Tel: (202) 514-2-SO OFf.DERED 
Fax: (202) 616-8202 

Brookl!ifn, New York 



m 



United SuitMi DUtrict Judpe 



FILED ELECTRONICALLY 
Honorable Eric. N. Vitaliano Pjf 
United States District Judgr^AM.' 
Eastern District of New York 
225 Cadman Plaza East 
Brooklyn, New York 11201 

RE: Rosato. et al. v. Nicholson, et al. No. CV-06-03( i;?( i (ENV¥JMA) 

Dear Judge Vitaliano: 

As discussed at the September 26, 2006 pre-motion hearing, and as further noted in the 
Court's September 26, 2006 Minute Entry, the parties have agreed upon, and request approval 
of, the following briefing schedule for defendants' motion to transfer ver ue pursuant to 28 
U.S.C. § 1404: 

♦Defendants will serve plaintiffs with defendants' motion to transf sr on or before 
November 17, 2006. 

♦Plaintiffs will serve defendants with plaintiffs' opposition to Xhs. motion to transfer on or 
before December 15, 2006. 



♦Defendants will serve plaintiffs with defendants' reply on or bedbre December 29, 2006, 
and that same date will, as required by the Court's individual mo :ion practice and rules, 
file a full set of the motion papers with the Court. 
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Respectfully submitted, 

PETER D. KEISLER 
Assistant Attorney General 
ROSLYNN R. MAUSKOPF 
United States Attorney 
ELIZABETH J. SHAPIRO 
Assistant Branch Director 



/s/ 



/s/ 



MARK D. SMILOW 

Weiss & Lurie 

The French Building 

551 Fifth Avenue, Suite 1600 

New York, New York 10176 

Counsel for Plaintiffs 



ORILEY 

Senior Trial Counsel 
DAVID M. GLASS 
Senior Trial Counsel 
HEATHER R. PHILLIPS 
Trial Attorney 
Counsel for Defendants 
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U.S. Department of Justice 

\jjss,\ Civil Division 

'**'*^^>^-i Federal Programs Bran cli 

P.O. Box 883 
Ben Franklin Station 
Washington, D.C. 2004'! 
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Tel: (202) 514-2395 
Senior Trial Counsel Fax: (202) 6 1 6-8202 



October 16, 2006 FILED 






FILED ELECTRONICALL Y 

Magistrate Judge Joan M. Azrack 

Eastern District of New York 

225 Cadman Plaza East 

Brooklyn, New York 11201 HHjH: Xjtl' ' - 

RE: Rosato. et al. v. Nicholson, etal.. No. CV-06-03 0{ l6 (ENV¥JMA) 

Dear Magistrate Judge Azrack: 

The above-captioned matter is a putative class action involving millions of potential 
plaintiffs alleging Privacy Act and other violations stemming from the ticft of a laptop from the 
home of a Department of Veterans Affairs employee in April of 2006. T-wo additional - 
virtually identical - putative class actions have been brought by differert named plaintiffs in the 
Eastern District of Kentucky and the District for the District of Columbia 

On June 23, 2006, the Court issued an Order setting an initial conference in this matter 
for October 24, 2006. Subsequently, on July 10, 2006 ^ defendan ts filed a motion pursuant to 28 
U.S.C. § 1407 with the Judicial Panel on Multidistrict Litigation ("JPMDi.") requesting a transfer 
of this case (as well as the case filed in the Eastern District of Kentucky) Ho the District Court for 
the District of Columbia. A hearing on defendants' § 1407 transfer motion was held before the 
JPML on September 28, 2006. The JPML has not yet ruled on defendant:?' motion. In addition, 
in the event that the JPML does not grant defendants' § 1407 transfer nnlion, defendants 
requested leave of the Court to file a transfer motion pursuant to 28 U.S C. § 1404. The Court 
granted defendants leave to file a § 1404 transfer^motion, and on October 13, 2006, counsel for 
.glaintilTand defendants filed ajoint briefing schedule with the Court, v/ith briefing to be 
conc lud e rby Decembe r 29, 2006. FihairyVoh SeptenSerTS;!^^^^^^ / 

entered into a Stipulation staying defendants' obligation to answer or oith€!i-wise respond to // 
plaintiffs' complaint until ten days after the Court's ruling on defendant:;' § 1404 transfer // 
motion. 

In light of the pending § 1407 transfer motion and the forthcomiing § 1404 transfer 
motion, and given that defendants have not yet answered the complaint, and have no obligation 
to do so until the Court has ruled on defendants' proposed § 1404 transfer motion, defendants 
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request that the Court adjourn the initial conference set for October 24, 2006, until after 
defendants' transfer motions have been decided. Counsel for plaintiffs informed counsel for 
defendants that he opposes defendants' request for adjournment of the initial conference. 

Respectfully submitted, 

PETER D. KEISLER 
Assistant Attorney General 
ROSLYNN R. MAUSKOP]:= 
United States Attorney 
ELIZABETH J. SHAPIRO 
Assistant Branch Directoir 

/s/ 



^C 



ORILEV 

Senior Trial Counsel 
DAVID M. GLASS 
Senior Trial Counsel 
HEATHER R. PHILLIPS 



'y7 J /) & V ~> HEAIHERR. 

y<>LL /t/ ^^J^ifO Trial Attorney 

dL ^ ^12 " 6> r^ ' ^^^ Counsel for Defendants 
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UNITED STATES OF AMFRir A "'-^^ 

^ICIAL PANEL ON MCLlSs^TmCT Si iGATIdJ. 



CHAIRMAN: 
Judge Wm. Terrell Hodges 
United States District Court 
Middle District of Florida 



MEMBERS: 
Judge D.LowellJensen 
"";^e'' States District Court 
Northern Distnct of California 

Judge J Frederick Motz 
United States District Court 
District of Maryland 

Judge Robert L. Miller, Jr 
United States District Court 
Northern District of Indiana 



Judge KathrynRVratil 

Judge David R. Hansen 
United States Court of Appeals 
Eighth Circuit ^^ 

Judge Anthony J, Scirica 



November 3, 2006 



sN CLERK'S OFFICE 
b. DISTRICT COURT, E.D.N.Y. 

Mb * 
BROOKLYN OFFICE 

DIRECT REPLY TO: 

JeffeiyN.Luthi 
Clerk of the Panel 
One Columbus Circle, NE 
Thurgood Marshall Federal 
Judiciary Building 
Room G.255, North Lobby 
Washington, D.C. 20002 

Telephone: [2021 502-2800 
Fax: J202I 502-2888 

http://www.jpmI.uscourts.gov 



Nancy Mayer-Whittington, Clerk 
1834 E. Barrett Prettyman U.S. Courthouse 
JJJ Constitution Avenue, N.W. 
Washington, DC 20001-2802 

Re: MDL-1 796 - ,„ re Department of Veterans Affairs (VA) Data Thett LitigTir 

"'"tZ^roT '-■■ ""•- ' ' ^«^'*'-. -«'.. I>. Districtof Cotabia, 
"""'""crN:. 2V6-Ur '""^^^^""'"-'°^^-™™'^^''- -"- ^.a Kentucky. 
M,cHae,Rosa,o. e,al. v. K Ja.es Nicholson e,al. E.D. New Yorlc. C.A. No. 1:06-3086 A .^v S 
Dear Ms. Mayer-Whittington: ( Z*^ -^ 

.heaJe^.S:iir'?re:s™:tr;:'s„:r^^^^ 

ceniJ^r.^e^S-r^S.'^.o^.^e'r^^^^^^ 

transfeired." ^^ ""^^'^ °^*^ '^'stnct court from ^Wch the action is being 

F.R.D. ^iZ;:t^^:t^^^^S^f^^^'Mm^^m>^ m 

d>efede^'c:r'rs:sit;Ts:t:d'S;ss'r;?^"«°^^ 

Judieial Conference. Therefore, yorcropemti™ tat^!!^ P '^'*/*' ^'^"^ ^''"^ Courts and the 
litigation would be appreciated. Wra^^pStolv inSd °' '^'^'^ °"'^ '^'^'^ °"^' 

each transferred action by yot^ couttX S^^on^L H T f " u''"™* *" ''™*'=' "'^^'^ ^'P^ to 
district; and copies of ordis re^g ap^C^"°S "™^^ "^ ^ -^"o"' originally filed t^your 
remands, and reassignments to other ST,^:^ Sc' ' ^"'™™'- '''^™^^'- ^"^'^ «>"" 
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Your attention is also directed to Panel R„i. 7 < 
actions. Upon notification from your courtTf a findin JT "^ termination and remand of transferred 



For your information, 



I am enclosing a copy of the Panel Attorney Service: List. 

Very truly, 

Jeffery N. Lathi 
, Glerk of thrPanel 




Enclosures 

Transferee Judge: Judge James Robertson 
ccw/orderonly: Transferee Chief Judge: Judge Tlonras F. Hogan 

cc w/order and Rule 1.6, R.P.J.P.M.L.: 

Transferor Clerk(s): Leslie G. Whitmer 

Robert C. Heinemann 

Transferor Judge(s): Judge William O. Bertelsman 
Judge Eric N. Vitaliano 



JPML Form 33 
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PLEASED FOR PUBLICATION ""~^^'^'^^™^ 
DOCKET NO. 1796 filed 

Ci-ERK'S OFFICE 

Vietnam Veterans of America, Inc., et al y « , 

Columbia, C.A. No. 1:06-10^8 """' A'«*<.(«./., e, uL, D. Dhtric. of 

P>.rsua|,t to 28 US.C. § 1407, for an order TenMkinfth^T, *' °='="<'»'^' ™ve the Panel, 
Col„„b,a. Plaintiff, i„ a, Disndc. of Dis nTof Columhi '?™ '" ""' ™=«" "^ 0'*!"=' <- 
PIa,m,fls,n,heEastemDistrictofKe„tuckyacta!„d,hlF ''"!"' .'Vpon defendants' motion. 
.he.ot,o„and,a,te™ative,y,suppor.t™3SrHrE«:^trttS;X^^^^ 

invoKeco"ltt°i;LrCL1re:S^^^^^ 

cfColu^biawillservetheconveni" eo?rp« rd^l"'"''^ 

conduct of ,h,s litigation. These actions are pu « ve natil^ h'T' """'"" ^^J"^' ^'^ ^fl5<^i™ 

concerning a May 3, 2006, theft of a laptop coruter al" ' tf ""'""^ *"' *"<^ -Jfeg^ions 

employee of the VA. The computer andZr '™''' '''»^'' >'""« from the home of an 

datesofbi^andsocialsecurit;rCtfaXTm™r2?,:?r'"" 

personjrel. Plamtiffsbring. inter alia,claimsunTrPrivLvAt.^^^^ 

Ccntrahzatton under Section 1407 is necess^n order ^et" ?'/■,' ''"■''8^'"="=f»d^^^^ 

~entpret.a,™,mgs,a„dconse„ethe^our;rpXr::::^^^^^^^^^^^ 
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preferable to Sectfon 1407 ce„traUzatior^dt";rT"'^^^^^ 
be„effiofplacingallacdonsinthisdockelbe&re,X!, •^■™'^f™'''^'-S^«^ 
.0 accommodate all partiesMegittoaleZ™^^^^^^ 

.hisi.j:orrDti?:^rro?c°:,^i«^^^ 

may be found, inasmuch as manySe defcl^Tm ?''" '*"'>' '*-a„: ,locumen,s and wtoSses 
the Washington, D.C., metropoC ta '' "" '°^''"' " "^» «*-' and the theft occ^X 

theDist!ifoJSoToi^™°»:cr;h:D^^^^^^^^^ 

consetit of that court, assigned to the HonSe ftmes Rot« ^ '' ^Columbia and, with the 
pretnal prooeedtngs with the action already pT^U^Thaf^s to" '" """''™'='' " --"""^^^ 



forthepa]m;l- 

Wm. TtJTelilH^dg^^ 
Chairman 
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^^^^^^ lEANSFER^FFILES 

transferred action. "^'"'^ ^'^' ^"^ ^ certified copy of the docket sheet fo/e,Vr''^ 

» ■— «M.»,«».Mit,'rri."'"r"-".>»"« 



remanded- ^^ ^"^^* ^'^'^ each action being 



(iv) 

(V) 



for any or aU prLeSs t„ 1/ h ^.''?^ ^>' ™™'"^' "^ ''«"« ""^^ A 
•he responsibly o?o„uns° oriZt^ ' '°"''™« '='"^<'- " ^l^" "« 

copies ,0 tte clerk of fte .rlXrdisrteUoS; °" """^' ™'"*" 
pursuant .his™:,** °'*' '"" *^" ^^ "°'«=^ *"» -X «<- have b=cn t^smitted 



